MANAGEMENT 


STRATEGY 


MEASUREMENT 


MANAGEMENT ACCOUNTING GUIDELINE 


Integrating Social 
and Political Risk 
Into Management 
Decision-Making 


By 

Tamara Bekefi 
and 

Marc J. Epstein 


Published by: 





NOTICE TO READERS 


The material contained in the Management Accounting Guideline Integrating Social and Political Risk Into Management Decision- 
Making is designed to provide illustrative information with respect to the subject matter covered. It does not establish standards 
or preferred practices. This material has not been considered or acted upon by any senior technical committees or the board of 
directors of either the AICPA or the Society of Management Accountants of Canada and does not represent an official opinion or 
position of either the AICPA or the Society of Management Accountants of Canada. 


MANAGEMENT 


STRATEGY 


MEASUREMENT 





MANAGEMENT ACCOUNTING GUIDELINE 


Integrating Social 
and Political Risk 
Into Management 
Decision-Making 


By 

Tamara Bekefi 
Harvard University 
and 


Marc J. Epstein 
Rice University 


Published by The Society of Management Accountants of Canada 
and The American Institute of Certified Public Accountants 





Copyright © 2006 by the Society of Management Accountants of Canada (CMA-Canada). 
All rights reserved. 
Reproduced by AICPA by arrangement with CMA-Canada. 


All rights reserved. For information about the procedure for requesting permission to make copies of any part of this work, 
please visit www.copyright.com or call (978) 750-8400. 


1234567890 PP 09876 
ISBN 0-87051-656-6 





STRATEGY 


INTEGRATING SOCIAL AND POLITICAL 
RISK INTO MANAGEMENT 
DECISION-MAKING 


INTRODUCTION 


The corporate risk landscape has shifted 
significantly in recent years. Larger and 
more varied risks than ever previously 
thought have been seen in companies 
and countries who had believed they 
were immune from those risks. Rapidly 
increasing globalization poses a common 
challenge—how to integrate the social 
and political risks of government 
instability, political corruption, business 
corruption, child labor practices, anti- 
corporate sentiment, terrorism, 
environmental pollution, and others, into 
management decisions. To date, no 
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adequate methodology for integrating 
these issues into risk management has 
been found. 


Developing and implementing an 
appropriate model for decision-making 
and measurement of social and 
political risks is critical for improving 
organizational performance by more 
effectively (a) anticipating, evaluating, 
preparing for, and mitigating risks, 
and (b) managing alternatives. To 
effectively manage risk and improve 
the resource allocation process, risks 
must be measured and integrated 
into ROI calculations. 


EXECUTIVE SUMMARY 


Today risks are both larger and more 
varied than ever previously thought. They 
are far broader and have been seen in 
companies and countries that thought 
they were shielded.With globalization 
increasing rapidly,a common challenge is 
how to integrate social and political risks 
of political instability, political corruption, 
business corruption, child labor practices, 
anti-corporate sentiment, terrorism, 
environmental pollution, and so forth 
into management decisions. 


This publication building on the model 
developed in the Management Accounting 
Guideline “Identifying, Measuring, and 
Managing Organizational Risk for 
Improved Performance” provides the 
tools, techniques, and specificity needed 
to aid managers to more effectively 
integrate social and political risks into 
their decision making processes. 
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These calculations can be applied to day-to-day 
operational decisions and capital investment 
planning, such as choices about plant location. 
Robust decisions under both circumstances are 
predicated on sound identification of risks, their 
assessment, and their mitigation and avoidance. 
We know, for example, that a wide array of 
political and social issues in both the developed 
and developing world can often cause a major 
impact on profits in an organization’s home 
country. These risks affect all types of 
organizations, including for-profit, non-profit, 
global, domestic, and large and small enterprises. 


Generally, risk can be described as any event or 
action that will adversely affect an organization’s 
ability to achieve its business objectives and 
successfully execute its strategies. Risk relates to 
the probability that exposure to a hazard will 
have negative consequences. Social risk relates 
to the potential impact of, for example, disease, 
damage to the environment, infringement of the 
rights of indigenous peoples, and challenges by 
stakeholders due to negative perceptions of 
business practices—all of which can jeopardize 
a company’s value. Political risk can generally be 
understood as execution of political power that 
threatens a company’s value. The distinction 
between social and political risk is, however, 
often blurred, and different sectors in varied 
locations can be affected differently by either 
kind of risk. 


Societal perceptions of the connections 
between a company and particular social and 
political risks can cause enormous costs to 
companies, regardless of the company’s direct 
involvement in the issue. Whether society is 
reacting to a real or perceived risk, it may take 
action, including consumer boycotts, leading to 
loss of sales or increased regulation that 
negatively affect a company, whether by (a) 
increasing its costs, or (b) prejudicing its 
achievement of business objectives or its ability 
to carry out its strategies. Thus, managing these 
types of risks is critical, whether they are real or 
perceived. (For further discussion of real and 
perceived risks, see Appendix 1.) 


Public perception of companies has proven to 
be an important component of risk. Research 
following anti-World Trade Organization 
protests in Seattle showed that investors drove 
down the market capitalization of companies 
without a reputation for corporate 
responsibility on average by $378 million per 


company, but did not penalize firms reputed to 
be socially responsible. (Schneitz and Epstein, 
2004). This demonstrates the significant positive 
financial impact of a reputation for managing 
social and political risks well. 


Companies must more clearly recognize the 
importance of (a) integrating a broader set of 
risks into management decisions, and (b) 
developing expertise in measuring the impact of 
social and political issues on financial 
performance. This clearer recognition requires 
managers to include measurement of social and 
political risks in ROI calculations. Currently, 
companies that do consider these issues often 
relegate them to a footnote in the reporting of 
investment decision and do not include them in 
calculating ROI.That effectively gives a zero 
valuation to risks that can negatively affect 
corporate earnings, shareholder value, and 
brand value. 


Some businesses are prone to social and 
political risk because of the location of their 
facilities, their product and customer 
characteristics, the nature of their employment 
relationships, or industry characteristics, etc. 
Well-known examples include Nike, Wal-Mart, 
and Shell, as well as the notorious social risks 
associated with industries like mining, footwear, 
apparel, toys, and chemicals. Also, varying social 
and political risks, and degrees of risk, affect 
companies located in specific countries or 
regions of the world. More globally, devastating 
terrorism attacks such as September | 1, 2001 
have dramatically increased risk, resulting not 
only in a terrible impact on individuals and 
government, but also an overwhelming impact 
on businesses. Corporations hoping to properly 
manage risk require more analysis, evaluation, 
preparation, mitigation, and response planning. 


This Guideline, aimed at CEOs, CFOs, and other 
top managers, provides a model for identifying 
and measuring social and political risk, and 
including these risks in ROI calculations, to 
create a more robust enterprise risk 
management (ERM) system. This modeling 
forms one small part of ERM, simply by including 
previously ignored risks. 


BACKGROUND 


In a recent Management Accounting Guideline 
(“Identifying, Measuring, and Managing 
Organizational Risk for Improved 
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Performance”), Marc J. Epstein and Adriana Rejc 
developed a model and measures for improving 
the identification and measurement of risks to 
improve management decisions. It built on newly 
created requirements for the assessment of risk 
of the Sarbanes-Oxley Act of 2002 in the U.S.,and 
similar new regulations in other countries. It also 
built on work by the Committee of Sponsoring 
Organizations (COSO) of the Treadway 
Commission and the recently issued Enterprise 
Risk Management Framework, by further 
specifying the necessary tools for identifying and 
measuring a broad set of organizational risks. 
More importantly, though, it focused on improving 
the quality and effectiveness of both operational 
and capital investment decisions, through more 
effective management of organizational risk. 


Epstein and Rejc demonstrated that increased 
measurement of a broader set of risks is 
necessary, both to meet recent regulatory 
requirements and to improve managerial 
performance and stakeholder confidence. They 
provided a risk assessment model, illustrated in 
Exhibit |, which builds on the 2004 COSO 
Enterprise Risk Management—Integrated Framework, 
and provides a scheme that classifies risk into four 
broad categories—strategic, operational, 
reporting, and compliance. 


Exhibit I: Risk Classification Scheme 


* Strategic risks relate to an organization's choice 
of strategies to achieve its objectives. 


* Operational risks relate to (a) threats from 
ineffective or inefficient business processes for 
acquiring, financing, transforming, and marketing 
goods and services, and (b) threats of loss of 
firm assets, including its reputation. 


* Reporting risks relate to the reliability, accuracy, 
and timeliness of information systems, and to 
reliability or completeness of information for 
either internal or external decision-making. 


* Compliance risks address the inadequate 
communication of (a) laws and regulations, 
(b) internal behavior codes and contract 
requirements, and (c) information about failure 
of management, employees, or trading partners to 
comply with applicable laws, regulations, contracts, 
and expected behaviors (Epstein and Rejc, 2005). 


Their risk assessment model serves as a basis for 
the following discussion of social and political risk, 
which falls predominantly in the strategic and 
operational segments of the Epstein and Rejc 
classification. This Guideline builds on the 
previous guideline by Epstein and Rejc, providing 
needed tools and techniques so that managers 
can more effectively integrate social and political 
risks into their decision-making. It will illustrate 
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why it is important for companies to understand 
social and political risk, and how to measure it 
for more effective risk management. 


Although identifying and classifying risks are 
critical first steps, it is essential to management 
practices that their impacts on the firm be 
measured. The previous guideline emphasizes 
the importance of assessing risks, both in 
terms of their cost if they materialize, and the 
benefits flowing from appropriate risk 
response. Of particular relevance to 
understanding, measuring, and managing social 
and political risk is the capability to quantify 
their potential impacts. 


We build on the previous guideline by describing 
how companies can more effectively integrate 
social and political risks into operational and 
capital investment decisions, including how to 
identify and measure them. The enhanced 
model also provides specific guidance that 
permits ROI calculations to include a formal 
and explicit assessment of these risks. This 
assessment will improve resource allocation 
decisions and risk management, both of which 
are the responsibility of senior corporate 
managers and boards of directors. 


CURRENT PRACTICES IN 
IDENTIFYING AND MEASURING 
SOCIAL AND POLITICAL RISK 


Companies face complex political and social 
challenges. They are wide-ranging and have 
different impacts on organizations, depending on 
sector, geographic location, and type of 
operation. Further, consideration of risk is 
substantively different if a company is considering 
opening a new venture or tackling challenges to 
existing operations. Previously, corporate risk 
was more narrowly focused on internal financial 
controls and corporate frauds. Now, identifying, 
measuring and seeking preventive or mitigation 
strategies to address social and political issues 
have become crucial to firms functioning in 
various countries.All companies are struggling to 
make business decisions that integrate financial 
information with insight into social and political 
concerns that can seriously affect their projects 
and bottom lines. Integration of social and 
political risks into the financial equation has, 
however, remained a challenge. 


Qualitative Approaches 


Techniques to evaluate and communicate 
political risk have been emerging since the mid- 


1970s, when multinational firms, particularly in 
the extractives and banking industries, built in- 
house teams employing political scientists and 
former CIA and U.S. State Department 
personnel. These teams looked at risk 
assessment qualitatively, producing detailed local 
briefings that outlined challenges in various 
locations.While providing sound insight into 
political instability and risks, these local briefings 
did not capture the cost of risk, because they 
failed to connect the issues to the business or 
explain their potential negative impact. For this 
reason, the briefings did not enable executive 
decision-makers to integrate these insights into 
business assessments. In fact, important 
information contained within those briefings was 
sometimes relegated to a footnote in the 
decision-making process. 


Quantitative Approach 


From the qualitative model emerged efforts to 
quantify political risk, to make it more relevant 
to corporate management. To accomplish this, 
various methods were developed. 


* Scorecards: Indicators of potential political 
and social risks, such as judiciary 
independence, corruption, and government 
turnover, were evaluated and assigned a 
numerical score. For example, a government 
viewed as highly corrupt could be assigned a 
10 in a possible scale of |-10.Then, depending 
on the methodology, the scores from these 
indicators were aggregated or the statistics 
were analyzed to generate a final measure 
that reflected the political risk of a country. 
An indicator listing that looks specifically at 
corruption, Transparency International, ranks 
the world’s countries on the basis of 
perceived levels of corruption. Another 
political risk consulting firm divides its 
indicators into four subcategories— 
government, society, security, and the 
economy—first calculating ratings for each 
subject, then aggregating them to create a 
national stability rating that can range from 
‘failed states’ to ‘maximum stability’. Such 
scoring is helpful, because it enables a 
comparison between countries. It falls short, 
however, of being directly useful to business 
decision-making, because the risks are not 
converted into monetary terms. (See 
Appendix 2 for a listing of companies that 
provide such data). 


* Statistical analysis: Probability analysis 
requires risk personnel to identify probable 
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issues and quantify them. Staff considers each 
risk and assigns a rating of high, medium, or 
low, and expected values, as well as a 
corresponding probability for an occurrence, all 
probabilities associated with a single risk 
equaling one. The data is then loaded into a 
spreadsheet application, such as Crystal Ball, 
which uses Monte Carlo simulations. Crystal 
Ball is an analytical tool that automatically 
generates equations to capture uncertainty, 
such as the cost of a coup to the company. It 
uses the Monte Carlo simulation model, which 
mimics the random chance of casino games, 
generating values for variables that have a 
known range of values, but an uncertain value 
for a particular time or event. Hundreds or 
even thousands of simulations can be run ina 
matter of minutes, and forecasts are generated 
for each point in the pre-determined range 
(high, medium, low) of risk. The results show 
project managers either the most sensitive 
issues on which to concentrate—sensitivity 
analysis—or a cumulative probability curve 
indicating the potential economic performance 
of a project—based on a pre-constructed 
decision tree that indicates key decisions and 
uncertainties.Although this methodology 
involves quantification and the consideration of 
potential risk impacts, the outputs of these 
calculations, which include charts, graphs, and 
dynamic models, cannot be integrated into 
financial evaluations. This is because they do 
not generate an ROI number, a political/social 
risk beta, or any monetary results that can be 
included in financial calculations. 


Scenario-based methods: Risk mapping is 
one method popular with corporations. This 
method plots the expected frequency, severity 
and degree of exposure of various risks on a 
graph, with probable frequency on the 
horizontal axis and expected severity on the 
vertical axis. (Birbeck, 1999). Calculations are 
made according to the following formula: 


Exposure = (event) x (hypothetical 
likelihood) x (hypothetical consequence) 


The benefit of such modeling is that it allows 
measurement of various types of risk, and 
enables managers to visualize where to allocate 
resources for risk management. In addition, 
mapping is a valuable communication tool, 
providing a comprehensible visual review of 
exposures, though they are not usually expressed 
in monetary terms. For this reason, mapping as 
currently practiced does not provide a link to the 
financial statement, or to the ROI calculation that 





is critical for comparisons between possible 
project options. With some modification, 
including assignment of monetary values to the 
hypothetical consequences, however, axis points 
on such a risk map could correlate to financial 
data and be integrated into ROI calculations. 


¢ Adjusted Discount Rate & Cost of Capital: 
One method of integrating social and political 
risks issues into financial modeling is the 
inclusion of social and political risk in a discount 
rate or cost of capital calculation that flows into 
cash flow calculations. This can be done by 
creating a social discount rate that employs the 
weighted average cost of capital (WACC) and 
the traditional capital asset pricing model 
(CAPM).This is done in three steps: 


|. calculate the cost of equity; 


2. develop the risk-free rate (RF) by assigning 
the long-term government bond rate; 


3. develop a risk-adjusted “beta”, based on the 
difference between the return earned by 
investors in an industry and the average 
return earned by investors in the market as 
a whole. 


When dealing with markets that may exhibit 
hallmarks of social and political risk, this adjusted 
WACC accounts for social and political factors. 


However, this method is difficult to implement. To 
date, the calculations for a risk-adjusted beta have 
relied largely on the standard country risk ratings 
methodology generated by political risk consulting 
firms (see Appendix 2 for more detail on these 
firms). Although useful as a theoretical methodology, 
such point-based risk ratings as the basis for beta 
calculations are too broad to achieve the needed 
objectives. These ratings are neither industry-, 
project-, nor company-specific, though social and 
political risks affect companies and their reputations 
differently, even if they operate in the same country. 
To be really useful as a basis for a social/political risk 
beta, the country risk ratings generated by political 
risk assessment firms require customization to 
particular companies, locations, and projects. 


We therefore propose another method to 
quantify social and political risk for inclusion in 
financial calculations, one that includes integrating 
the costs and probabilities of each social and 
political risk, and calculating an expected value. 


Observations 


In a recent survey of risk management executives, 
more than 60% of respondents anticipated a 
continuation of “significant external risk” in the 
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next five years, based on recent historical events 
(The Conference Board and Mercer Oliver 
Wyman). According to a McKinsey global survey 
of business executives, 


* Only 3% of the 4,238 executives who 
responded to a poll reported that their 
companies were doing a good job of 
anticipating risk. 

* 46% of respondents said they have 
“substantial room for improvement.” 


This growing recognition of the need to better 
integrate insight into how social and political 
issues may affect the firm necessitates an 
adequate methodology to quantify these issues 
in a way that supports effective management 
decision-making. 


Given the lack of such a methodology to date, 
most companies largely make capital investment 
decisions and operational choices with a 
primary focus on financial risk, as it is most 
narrowly defined. As a result, they fail to make 
a more comprehensive calculation that could 
substantially affect decision-making and 
corporate financial performance. Currently, 
there is a tendency to separately treat financial 
risk, which has traditionally been measured, and 
social and political risk, which has historically 
been analyzed qualitatively,and now more 
recently quantitatively, to produce weighted risk 
indicators and maps. In cases where these 
issues have been considered, they have often 
been relegated to an addendum to the 
investment decisions process and are not 
included in the calculation of ROI.This places a 
zero dollar value on potential risks that can 
damage profits. As a result, operational and 
other decisions are often based on quantified 
financial factors, simply for methodological 
reasons, leaving key issues, which may have 
dramatically negative impacts on ROI, 
unaccounted for. 


Many components of risk must be included in a 
comprehensive risk assessment. Although 
measuring some of them is only possible 
through estimating rather than exact 
calculation, all risks can be quantified to some 
extent. If they are not then included in financial 


calculations, the company will often 
inadequately integrate these risks into 
management decisions and simply gamble that 
they will not emerge. Discussing the 
importance of these risks and their potential 
impact is not intended to inhibit investments. 
Rather, including these risks in calculations 
aims at creating more informed decisions. 
The very act of deciding on a number (or a 
range) to include in calculations means that 
decision-makers are discussing these issues 
and their importance. There is, however, a 
danger of declining to invest because hurdle 
rates were not met due to inclusion of social 
and political risks, without senior management 
ever being aware of it. Therefore, it is critical 
to share the thinking and decisions made in 
assigning risk values. This is discussed more 
fully in a later section. 


Further, without fully understanding some of the 
complex risks facing the business, (a) decision- 
makers may not include pre-emptive measures 
into project planning and execution, and (b) 
opportunities for growth and profit from day-to- 
day operations may be lost. 


INTEGRATING SOCIAL AND 
POLITICAL RISKS INTO GENERAL 
RISK MANAGEMENT 


To manage risk effectively requires: 

* comprehending the socio-political and 
corporate environments that might affect risk; 

° identifying risks; 

* evaluating and measuring their potential effects; 

¢ identifying and analyzing possible solutions; 


* adopting the most appropriate risk 
management actions; 


* communicating results; and 


* monitoring evolving risks. 


In this section, we build on and modify the Risk 
Management Process model provided in the 
2005 Management Accounting Guideline’ 
(Exhibit 2), by including social and political risk, 
and offering additional tools and techniques to 
enable companies to integrate these new risks 
into management decisions. 


|. Epstein, Marc J. and Adriana Rejc Buhovac. Identifying, Measuring, and Managing Organizational Risk for Improved 
Performance. Risk Management Accounting Guideline. CMA Canada and AICPA. 2005. 
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Exhibit 2: Risk Management Process 
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¢ there is the perception that local 
expectations are not being met; 


* the surrounding area is being polluted; or 


* business is undertaken in a region of general 
political unrest, where the military is 
protecting a site and using its presence to 
harass the local population for reasons 
unrelated to the business. The local population 
can sometimes associate the company with 
these practices, and begin to target it as a 
proxy for the government or the military. 


The experience of US-based Freeport McMoran, 
which owns a large gold and copper mine in 
Papua, Indonesia, is a case in point. The company 
lost approximately $48 million and 20% of its 
share price’ due to clashes with the populations 
surrounding the Freeport mine. Tension had 
already mounted in the region because of a 


December, 2005 New York Times report that 
Freeport, which employs 180,000 people and is 
one of Indonesia’s largest taxpayers, had paid 
Indonesian military and police officers close to 
$20 million between 1998 and 2004, leading to 
an investigation by the U.S. government and 
protests by the local population.’ 


Further ill-will brewed when poor residents near 
the Freeport mine, with few economic 
opportunities, began prospecting for gold in the 
waste rock from the company’s operations. 
Citing possible health concerns from exposure 
to this material, the company moved to prohibit 
prospecting, positioning private security guards 
around the mine, who allegedly had authority to 
shoot at prospectors. The local community, 
however, was suspicious of the cited health 
reasons, as it already perceived that a large 
foreign company was making huge profits from 





In Exhibit 3, we illustrate how companies can 
include social and political risk into overall risk 
management. We include the detailed steps and 





analysis necessary to identify and assess political 
and social risk in a manner that is relevant to 
financial decision-making. 








Exhibit 3: Social and Political Risk Integration Model 
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2. Pan, Esther. ‘Small Window for Peace in Papua,” Council on Foreign Relations. April 19, 2006. 
http://www. cfr.org/publication/10484/small_window_for_peace_in_papua.html 





3. Seelye, Katharine Q.“Indonesia: Mining Company Notes U.S. Review of Payments to Indonesian Military,’ The 


New York Times. January | 9th, 2006. 
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use of its land. Impoverished local residents 
believed that they were being unjustly prevented 
from sharing, even marginally, in the big company’s 
wealth. In reaction, the community began protests 
that closed the mine for four days—at an 
approximate cost of $12 million a day. 


Nigeria presents another example of risks that can 
emerge on the arrival of a large company to a 
relatively isolated or under-developed area. The 
arrival of petroleum companies created 
unintended consequences when a sudden influx of 
people, mostly unskilled, began looking for work at 
the oil installation. When no jobs were available, 
some turned to violent behavior.A number of 
unemployed Nigerian youths began attacking oil 
pipelines, taking personnel hostage, and in one 
case, seizing an offshore oil rig, demanding that 
they be given jobs.* 


A further potential unintended long-term 
consequence of new operations is the focus of the 
local economy exclusively on one industry over a 
long period of time, resulting in dependence on 
one company, operation, or industry sector.When 
the company leaves or the industry is no longer 
viable, the surrounding area is usually economically 
devastated, creating a potential backlash against 
the company by local populations. This has 
happened frequently in company towns in the U.S. 
and abroad, in industries ranging from steel milling 
to coal mining. For example, Detroit, Michigan saw 
a tremendous dip in its standard of living when the 
automotive industry became less competitive. 
Some industries are less prone to these risks, but 
it is critical that companies that must or choose to 
remain in one location for the long-term, 
understand and mitigate these risks. In many cases, 
mitigation calls for both an effective community 
relations strategy, as well as an exit strategy that 
deals with both environmental and economic 
issues to diminish negative consequences. Risk 
mitigation is discussed in a later section. 


Health, safety, and environmental issues affect all 
companies. Recently, debate has begun on 
regulating emissions at major U.S. ports. This 
would create additional unexpected costs for 
both freight companies and importers and 
exporters of goods from places like the Ports 
of Los Angeles and Long Beach. 


4.“Nigerian oil fuels Delta conflict,’ BBC, January 16,2006. 


Companies working internationally face often 
costly worker and community health issues for a 
variety of reasons, including lack of adequate 
medical care in certain regions of the world. HIV 
infection has become a particular risk for 
companies in the extractive and transportation 
sectors, both heavily male-dominated, where 
operations attract increased prostitution. This 
increased level of HIV infection of workers can 
quickly lead to sickness and eventual death. Left 
unchecked, this trend will expose companies that 
have trained workers and rely on their skills for 
production to additional costs. Road accidents, a 
killer that will eclipse both AIDS and war by 2020 
according to the World Health Organization, also 
represent a tremendous cost to companies reliant 
on long-haul trucking. 80% of total road deaths 
occur in developing countries, often resulting from 
overcrowded vehicles and an unsafe mix of 
animals, people and vehicles on the road. 
Statistically, companies that rely on roads in these 
parts of the world will be exposed to loss of their 
drivers or cargo due to unsafe road conditions. 
Some companies try to mitigate this risk by 
training their own staff and contract drivers, as 
well as working with other companies and 
multilateral organizations to address road safety.° 


Using labor forces—ike children and forced 
labor—that certain societies consider 
unacceptable can put companies at risk. In some 
areas of the world it is customary that children 
work, and this is one of the better options 
available to them. However, use of child labor has 
led to product boycotts by customers opposed to 
the practice and terrible publicity. The use of 
forced labor, a practice that has been exposed in 
the supply chain of some companies, can also 
create great problems, even if the company did 
not directly employ this labor. In 1996, activists 
and Burmese villagers filed a lawsuit against 
Unocal under the Alien Tort Claims Act (ATCA). 
The ATCA grants to a U.S. federal court 
jurisdiction over a claim, when a non-U.S. citizen 
or alien sues for a tort committed in violation of a 
United States treaty or other international law. In 
this ATCA case, Unocal was accused of (a) 
complicity in the Burmese military's use of forced 
labor to build the Yadana pipeline, of which Unocal 
was a junior partner, and (b) allowing Burmese 


5. Bekefi, Tamara. The Global Road Safety Partnership and Lessons in Multisectoral Collaboration: Corporate Social 
Responsibility Initiative, Kennedy School of Government, Report # |—August 2005. 
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troops guarding the project to rape, murder, and 
enslave villagers. The company denied any part in 
these human rights abuses, but settled the suit 
for an undisclosed amount of money in 2004.° 


All of these social issues emerged as risks to 
companies, and some risks took companies by 
surprise and came at a great cost. The largest of 
these costs, lost sales and profits, often results 
from damage to reputation. Other risks that 
present a potential monetary liability seem 
poised on the horizon. One example is climate 
change, which may present a potential future 
monetary liability. Although there is still debate 
on climate change and liability is not a certainty, 
its likelinood warrants some companies to 
consider it by factoring it into decision-making. 


Political Risk 


Generally, political risk can be understood as 
execution of political power in a way that 
threatens a company’s value. Two types of 
political risk are relevant to companies doing 
business internationally: industry- or firm- 
specific political risk and country-specific 
political risk. On the one hand mass anti- 
government protests, then, may not pose a 
political risk to a firm if they do not affect 

(a) government policies towards business, or 
(b) the firm’s current or future operations or 
value. On the other hand, changes in the legal 
framework governing contracts could have a 
significant negative impact on the company. 
Industry- and firm-specific political risk is 
experienced by one industry or firm, such as 
threats by Bolivia’s President Evo Morales to 
nationalize the country’s oil and gas sector. 
Companies including Brazil’s Petrobras and 
Spain’s Repsol YPF have invested $3.5 billion into 


developing Bolivia’s natural gas fields, the 
second-largest natural gas reserves in South 
America.’ Morales’ threats have recently been 
translated into specific actions against foreign 
energy companies, beginning with (a) forced 
audits of their financial documentation, and (b) 
the demand to renegotiate concession 
agreements and revenue-sharing from gas field 
development to give the government a majority 
stake within six months. 


Sector-, provincial-,and country-specific political 
risk is spread more widely. These risks can 
include a civil war, drastic changes in foreign 
currency rules, or sweeping changes to the tax 
code. These types of risks can be generated 
directly from the host country government, or 
emerge from an unstable social situation within 
the country. Regardless of the source, a 
company attempting to understand potential 
political risk must recognize the difference 
between (a) political issues that can affect 
corporate performance, and (b) dramatic 
situations that have no financial impact on the 
company. In addition, companies should 
understand the potential reputation damage, 
and associated costs, related to political risk. 


The distinction between social and political risks is 
often blurred.We consider these issues to fall 
along a continuum, as illustrated in Exhibit 4.The 
subjects in Exhibit 4 are only some of the most 
critical social and political risks facing global 
companies today. Although the Exhibit does not 
try to list all risks, the wide variety of risks it 
includes provides a sample of relevant issues facing 
companies. Each organization should generate its 
own list of social and political risks, based on their 
relevance to its business(es) and the business 
environments in which it/they operate(s). 


6. David Baker.“‘Purchase of Unocal by Chevron Deal puts new sources of gas and crude in the right places for 
East Bay oil giant,” San Francisco Chronicle. Tuesday, April 5, 2005. 


7. The Economist, December 2005. 
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Exhibit 4: The Social-Political Risk Continuum 
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Developing a Risk Profile potential for solutions. Developing a risk profile 


, . See has two elements: 
To effectively manage social and political risks 


means, first and foremost, being able to identify 1) Identify enterprise risk sources 

risks that face the firm from various sources, and 2) Identify company- or project- relevant social 
handle them within a larger risk management and political risks 

framework. This allows decision-makers to 


develop a situation or project-specific risk profile  Ejement I: Identify Enterprise Risk Sources 
that will help to (a) reduce unwanted surprises, 


(b) minimize the negative effects of external When developing a situation- or project-specific 
factors on the business, and (c) maximize the risk profile that includes social and political 
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Risk 
Sources 


issues, it is critical to be aware that these 
issues are experienced quite differently, 
depending on a firm’s sector, industry 
characteristics, product(s), customers, 
geographic location(s), and employment. 
Identifying the sources of risks is also helpful 
for the following reasons: 


¢ Identification helps refine the list of issues 
that could affect one’s company, 


* Response strategies will be more effective if 
the sources of risk are known, permitting 


managers to address the issues at their source. 


Exhibit 5 illustrates some of the sources of risk 
that may help to formulate a risk profile. 


Companies in different sectors can face 
significantly different risks, as well as attracting 
different outside scrutiny on diverse issues. The 
risks that emerge from such scrutiny have 
affected companies, and in many of the first 


cases, companies were surprised to be accused 
of socially unacceptable behaviors: 


¢ The oil, gas, diamond, and gold industries have 
been accused of adverse environmental 
impacts, human rights abuses, negative effects 
on local communities, and sometimes of 
colluding with corrupt governments in 
developing countries. These industries also 
face issues simply because of their operating 
environments. An extractive company may 
undertake new operations in countries with 
unstable political environments where 
corruption may be rampant; the judiciary 
may be too weak to enforce contracts; and 
infectious disease may wreak havoc on 
skilled labor. These challenges would likely 
not emerge if the company were beginning 
a project in North America. Extractive 
companies may be forced to operate in an 
unstable environment, as they must go where 
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the product is found. Companies in other 
sectors are often not so limited. Companies 
having or choosing to operate in higher risk 
environments must identify these risks as a 
first step in evaluating and managing them. 
DeBeers, which operates in regions where the 
incidence of HIV/AIDS is the highest in the 
world, calculates that 10% of its employees 
were likely infected with HIV and that a 
program to treat its infected employees would 
cost the company US$1,200-US$3,500 per 
worker annually for 10-14 years. DeBeers 
considered this a cost-effective approach 
compared to its other two choices: (a) the 
cost of losing HIV-infected workers to AIDS- 
related illness and death requiring the hiring 
and training of new workers, or (b) the cost 
and inefficiency of hiring and training three 
workers for each job, to prepare for AIDS- 
related losses. DeBeers is currently 
implementing an HIV/AIDS employee 
education and treatment program.’ 


¢ Footwear and clothing production have been 
associated with low wages, child labor, and 
unfair working conditions. Companies with 
manufacturing operations in developing 
countries, and thus faced with non-Western 
labor practices in areas such as wages, 
overtime, and child labor, find that these 
practices are often scrutinized by the media or 
the companies’ customers both of whom are 
sensitive to these practices. 


a Nike was accused of employing children as 
young as ten years old in Cambodia and 
Pakistan to produce sneakers, clothing, and 
footballs, leading to consumer boycotts. 
These consumers did not differentiate 
between the company and its subcontractors. 


« In 1997, Kathy Lee Gifford’s clothing line 
came under attack when the news media 
broke a story alleging that the television 
star’s clothing line was being manufactured 
by Honduran women and girls as young as 
12, who were working in dreadful conditions. 


« In September 2005, a class action lawsuit was 
filed against Wal-Mart on behalf of workers 
in Bangladesh, Swaziland, Indonesia, China, 


and Nicaragua. The lawsuit alleged that the 
world’s largest retailer had failed to monitor 
working conditions in its supply chain, and 
that its demand for low prices forces 
suppliers to enforce sweatshop conditions. 


* Acomputer chip manufacturer might struggle 
with stakeholder reactions to chemical use and 
its impacts on the local environment. These 
business-to-business industries are often 
affected less by damage to reputation related 
to social and political issues than are 
companies in other sectors. 


Telecommunications firms may face negative 
reactions by its customers over use of their 
personal information and records of their use 
of the telephone or Internet. Refusing to 
share such information, however, may present 
other risks. Recently, news has emerged that 
the U.S. National Security Agency (NSA) has 
been secretly collecting the telephone records 
of millions of Americans by agreement with 
AT&T,Verizon, and BellSouth. When QWEST, a 
fourth company, declined to participate, the 
NSA threatened negative consequence in 
government dealings for failure to cooperate.’ 


* Prescription drugs and their producers have 
been linked to developing countries’ lack of 
access to essential medicines. HIV/AIDS drug 
producers were boycotted because they would 
not lower product prices in South Africa. 


* Food and beverage companies have been 
associated with the obesity epidemic; 
McDonald’s has been accused of encouraging 
obesity through marketing its products. 


The obesity-related lawsuit against McDonald’s 
was revived in January 2005, and has led to more 
general changes in both production and 
marketing practices of the food industry. 
McDonald's began to offer salads and fruits in 
addition to the traditional hamburgers and 
French fries, and PepsiCo’s Frito-Lay snack unit 
replaced trans-fats with corn oil in its products at 
a cost of $57 million, and began producing 
reduced-fat Lay’s potato chips and Cheetos.'° The 
threat of legal liability could reach as far as local 
supermarkets and convenience stores, since 
recent studies have found that products in stores 


8. Global Business Coalition on HIV/AIDS <www.businessfightsaids.org> 


9. Cauley, Lesley.“NSA has massive database of Americans’ phone calls.” USA Today May | 1, 2006. 


10.“Food Giants Scramble to Avoid Lawsuits.” The Agribusiness Examiner, August 30, 2004. 
http://www.organicconsumers.org/school/obesitylawsuits083004.cfm 
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located in the poor neighborhoods of North 
America offer more convenience (junk) food 
and few fresh fruits,and hardly any vegetables.'' 
Some convenience store chains like 7-Eleven are 
responding by offering organic and healthier 
snacks to consumers. 


Companies beginning to identify social and 
political risks that may affect them or their 
products must understand the setting for their 
businesses, and how that setting might generate 
risks. This process need not necessarily be 
costly and time-consuming, though the degree of 
investment in risk identification would likely 
depend on the size and importance of the 
company or project. 


Risk may emerge simply from: 


* Operating Location: Locating a plant in 
Myanmar, where a totalitarian military 
government is known to encourage the use 
of forced labor, will likely pose more risks 
than doing business in Singapore, where this 
is not a common practice. Likewise, opening a 
pub near a school may generate protests 
from the local community. 

* Reaction of society or a group of people 
affected by, or who believe they will be 
affected by, business activities: |n Peru’s 
Cajamarca region, Newmont Mining has been 
grappling with the local community's 
dissatisfaction and its sometimes violent 
reactions. This is based in part on changes in 
the community since the arrival of the mine, 
such as rising housing prices and inflation. It 
is also based on the perception that mining 
operations have contaminated and siphoned 
off local water supplies, and are negatively 
affecting human health, farming yields, and 
fishing. The matter is further complicated by 
involvement of activist groups, who are using 
the Internet to spread information, in some 
cases destabilizing relations between the 
company and the community. Local distrust is 
at such a high level that when Newmont 
Mining began exploration of a nearby 
mountain as a potential site for further 
mining activities, rioting began and the 
company abandoned its expansion. 


¢ An employee base that is deemed 
unacceptable to society:VVal-Mart recently 
settled a lawsuit brought by the US. 
Department of Labor for $135,540, for 24 


violations of employing teenagers and allowing 
workers to operate hazardous equipment.” 
Although the amount of the settlement may 
be insignificant to the company, the negative 
impact on its reputation is reverberating 
through the company. 


The new power of communications technology 
to spread information quickly and efficiently, with 
little oversight, means that companies have to be 
even more aware of their social and political 
risks to avoid targeting by activists. This is 
discussed further in Appendix |: Real vs. 
Perceived Risk. 


Exhibit 6 outlines some of the social and political 
risks generated by product, sector, customer, 
geographic location, employee base, and industry 
characteristics, as well as examples of industries 
affected by these issues. Risk can be divided into: 
(a) risks to society that could create 
dissatisfaction, and (b) other issues that could 
negatively affect the company, thereby posing 
risk to the company. Analyzing the 
characteristics of these two kinds of risk, aids 
companies in understanding their potential 
impacts on the company or project, a critical 
first step in developing a risk profile and 
estimating the effect on profitability. 


A comprehensive risk identification process will 
ascertain risk variables that may apply to one’s 
company. Additionally, identifying the issues to 
which stakeholders may be sensitive (if they 
were to discover companies engaged in them) is 
important, since the financial effects of 
stakeholder reactions can be significant and 
easily spiral out of control. 


Element 2: Identify Company- or Project- 
Relevant Social and Political Risks 


Next in critical importance after identifying 
general enterprise risk sources and issues 
(Element 1) is identifying company- or project- 
relevant social and political risks. These can vary, 
depending on specifics such as location within a 
country, and can be more nuanced than those 
previously identified. The discussion of risk 
management often focuses on financial issues, to 
the exclusion of other similarly important matters. 


Although the CEO and the board are the 
ultimate risk managers in the company, 
employees in many parts of a company can 


11. “Where You Live Affects What You Eat.” NAASO, The Obesity Society. http://www.naaso.org/news/2004 | | 18.asp 


12.“Wal-Mart settles child labor cases. Company denies charges but agrees to pay penalty.’ Associated Press, 


February 12,2005. 
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EXHIBIT 6: EXAMPLES OF RISK SOURCES & CORRELATED 
POTENTIAL RISKS 


Source Examples Risk 


Risk to Society Risk to Companies 


Product Diamonds ¢ Diamond trade and 


revenues being siphoned 
off by corrupt governments 
and rebel groups, thereby 
fueling civil wars in Africa, 
e.g.Angola 


Petroleum 
products 


* Negative environmental 
impact 


Fast food, 
snack foods, 
soft drink 
manufacturers, 
food retailers 


* Increased consumption of 
unhealthy food and drinks 
negatively affecting obesity 
in the developed world 
and potentially the less 
developed world 


* Lack of access to medicines 
in developing countries, 
e.g. South Africa and 
HIV cocktails 


Prescription 
drugs 





* Business disruption, threats to employees 

* Reputation: profits from legal diamond 
mining fueling civil wars in Africa. 

* Accusations of profiting from trade of 
“conflict diamonds” may affect sales and 
product reputation 


* Consumer boycotts/protests and pressure 
from employees (both existing and potential) 


* Long-term business sustainability 
(need to replace reserves, etc.) 

* Imposition of legislation to manage 
emissions, creating a cost to the 
company and consumers of its products 

* Reputation: fossil fuel emissions 
correlated to climate change 


* Reputation: blaming food and drink 
manufacturers, as well as retailers, for 
producing and marketing food to consumers 
who over-consume, thereby suffering from 
obesity and related health problems 

* Obesity lawsuits that, to date have been 
thrown out of court, but may still pose 
significant potential liability, as was 
exemplified by tobacco lawsuits. These suits, 
whether or not they lead to payouts, take time 
and energy from corporate legal teams and 
executives to address, at considerable cost 
to the firm. 

* Reputation: Anger in developed world about 
lack of access to essential medicines for 
the world’s poorest leads to action and/or 
public protest in developed countries where 
companies are based 

* Cost to pharmaceutical companies of 
filing lawsuit to overturn South African 
law lowering price of HIV medicines 

* Cost of withdrawing the suit and public 
outcry at blocking access to medicine in 
Africa. Consumer boycotts/protests and 
pressure from employees (both existing 
and potential). 


* No legal liability but cost of negative 


public opinion once the issue 
becomes public. Consumer boycotts/ 
protests and pressure from employees 
(both existing and potential). 
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MANAGEMENT 


STRATEGY 


MEASUREMENT 





EXHIBIT 6: EXAMPLES OF RISK SOURCES & CORRELATED 
POTENTIAL RISKS (continued) 


Source Examples Risk 


Risk to Socie Risk to Companies 


Shoes, clothing, * Potentially poor working Reputation: Accusations by consumers 
toys conditions, including long of sweatshop conditions leading 
hours and little pay to boycotts of products 

No legal liability but cost of negative 
public opinion once the issue becomes 
public. Consumer boycotts/protests and 
pressure from employees (both existing 
and potential). 


rT 








Chocolate * Slave labor, child labor Reputation: boycotts of products and bad 

and people trafficking in publicity connected to use of slave and 

West Africa child labor, as well as human trafficking 
Lawsuits under the Torture Victims 
Protection Act and the Alien Tort 
Claims Act (U.S. court). 
Consumer boycotts/protests and 
pressure from employees (both 
existing and potential) 


Chemical * Negative environmental Fines by government 

impact Lawsuits 

* Employee health Remediation 

* Community safety Consumer boycotts 

* Risk perception Inability to recruit talent 

* Long-term hazards that may * Reputation risk 
not be currently understood 
but may take years to emerge 


Companies that sell products such as 
diamonds, fast foods, snack foods, soft 
drinks, chocolates, shoes, clothing, toys, 
furs, etc. could be faced with the same 
risks as the producers and may be met 
with lawsuits and/or boycotts 


Customer Socially Reputation issues 
responsible Consumer boycotts 
consumers Inability to recruit talent 
(particular 
correlation 
with products 
produced in 
developing 
markets) 


Geographic Stable * Locating certain businesses * Limits ability to open in certain locations 
location? developed near particular areas Consumer reputation risk 
country (taverns, liquor stores 
near schools). 





13.The distinction between developed and developing countries is often based on levels of economic 
development, which are usually closely associated with social development, in terms of education, health care, 
and life expectancy. The United Nations’ Human Development Index (HDI) serves as a measure of 
development, as does the World Bank’s Country Classification Database, which uses gross national income (GNI) 
to classify economies and their level of development. 
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EXHIBIT 6: EXAMPLES OF RISK SOURCES & CORRELATED 


POTENTIAL RISKS (continued) 


Source Examples 


Risk 


Risk to Society Risk to Companies 


Unstable 
developing 
country 


Employees Children 


Adults 


Non-diverse 
workforce in 
North America, 
Europe 


* Government is supportive 
of company but local 
population could be 
dissatisfied 


¢ Working at young ages 
[This may not be as much 
of an issue for local 
population when the 
alternative to child labor 
can be a worse option, 
such as child prostitution 
or homelessness] 


Female employees’ 
exposure to hazardous 
materials that cause 

birth defects 

Social issues with 

women working 
Discrimination 

(Men) Working, particularly 
in extractive and transport 
industries, away from their 
families and communities, 
risk exposure to sexually 
transmitted diseases (STDs) 
and increased drug and 
alcohol use. The STD is 
often transmitted to others, 
including women along the 
trucking route or wives. 





* Potential for corruption creating difficult 
situations when trying to uphold home 
country law [such as Foreign Corrupt 
Practices Act (U.S.)] 

Legal framework where contracts cannot 
be enforced creating an uneven playing field 
Targeting by predatory government with 
potential for nationalization of assets 
[Bolivia LNG,Venezuela general corporate 
challenge] 

Targeting by insurgents or other 
non-government actors [i.e., insurgents if 
company seen as colluding with government 
(Colombia)] 


Reputation issues: Anger in consumer 
markets about use of child labor 
Violation of child labor laws 


Loss of skilled employees 

Health problems among employees 
Potential that consumers will react 
negatively to poor working conditions 
Lawsuits 

Increased absenteeism due to illness, 
higher turnover of workers due to 
HIV-related deaths 

Increased instance of industrial accidents 
because of intoxication by drugs or alcohol 


Lawsuits filed under laws such as the 
Racial Discrimination Act, the Sex 
Discrimination Act 

Reputation loss that affects ability to hire 
talented workers 

Legal fees 

Inability to recruit 

Potential obstruction in capturing growing 
minority markets 
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integrate risk management into their jobs. 
Financial risk is usually managed in a specific and 
established manner. On the other hand, the 
intensification of social and political risks often 
requires an integrated risk management process 
across a firm, to adequately identify emerging 
issues. Personnel who can become aware of risk 
at an early stage include a line manager at a plant 
in a developing country. That manager may be 
aware of negative community reactions to the 
corporation through discussions among 
workers, or from personnel in public affairs who 
learn of negative government attitudes to the 
firm while lobbying. These first signals can herald 
much larger issues if left ignored. 


To anticipate social and political risks, personnel 
must be aware of what constitutes risk to the 
firm, and understand how to identify these risks. 
Identification is a two-step scanning process: 


1) Generate a risk profile for the corporation 
(Element |) that can include some of the 
issues illustrated in Exhibit 4. A variety of 
risks can materialize from factors such as 
sector, industry characteristics, product, 
customers, geographic location, and 
employment. A risk profile is simply a list of 
risks generated from these contextual issues. 


2) Generate a risk catalogue for the 
corporation (Element 2): risks can be specific 
to a particular project or location. For 
example, a new shoe manufacturing plant in 
Bolivia will face different risks than an existing 
refining facility in Oman. A risk catalogue is 
simply a more specific list of ‘red flag’ issues, 
developed from the general risk profile, that 


are connected to a certain project or location. 


Existing Operations vs. New Investments 


Evaluating and responding to risks is significantly 
different for existing operations than for new 
investments. Ongoing operations are often 
difficult or costly to uproot if a major risk 
materializes. In some cases, such as extractive or 
other materials-based operations that bring a 
company to a particular location and require large 
initial investment, the risk would have to be 
imminent, or have the potential to exact 
enormous consequences, to warrant moving 
operations or withdrawing. When ongoing 
operations face social and political risks, they must 
find ways of minimizing their impact, while 
maximizing their potential for continuing 
operations. The same applies to changes to 
operations that generate risk. However, when 


new investments are considered, companies can 
evaluate a variety of locations and compare their 
risk impacts. In addition, evaluating risk for new 
operations can present opportunities for pre- 
emptive mitigation and management of unavoidable 
risks. That is not possible in ongoing operations. 
Risk mitigation is discussed in a later section. 


Reputation Risk 


For most firms, reputation is a large issue, and 
intangible assets such as brand can account for 
over 60% of a company’s market value. 
Reputation damage from issues such as negative 
publicity and costly litigation can create a loss of 
revenue, a decline in customers, or the exit of key 
employees. (Argenti; 2005) Negative perceptions 
about a corporation can emerge from the social 
and political issues it deals with, and put the 
company’s reputation at risk. Although a good 
reputation can have potentially positive outcomes, 
such as (a) enhanced access to capital markets, 
and (b) the ability to attract investors and better 
employees, and charge premium prices, the 
converse can also be true. Reputation issues 
arising from social and political risk can negatively 
affect the organization as much as the risks 
themselves, and can account for some of the 
largest costs—lost sales and profits. As a 
component of social and political risks a company 
faces, reputation risk also needs to be managed. 


Increased consumer interest, instantaneous 
communication via the Internet, and professional 
activist organizations have generated new 
challenges for companies trying to manage 
reputation risk. They must identify the 
stakeholders that may be affected by, or may 
have an impact on, a particular issue. Exhibit 7 
illustrates stakeholders that may be involved. 


Evaluating a firm’s stakeholders and the 
reputation risks they may generate is an 
important part of creating the corporate risk 
profile. Identifying these reputation risks follows 
the same steps used in identifying political and 
social risk. Identifying the stakeholder group that 
is the source of this reputation risk is also critical 
to creating mitigation strategies. Risk 
identification does not have to be a long and 
costly process—even a few people spending a 
few hours discussing and identifying risks, and 
assigning probability values to them, can produce 
helpful, if not precise, results. This is better than 
no risk deliberation at all. More thorough 
deliberations can be expected when more 
money is at stake. 
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Exhibit 7: Potential Stakeholders 
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Embedding Risk Identification into 
Corporate Activities 


Identifying a company or project's social and 
political risks, and their associated reputation risks, 
should generate a company- or project-specific 
risk catalogue that includes all relevant risks and 
their sources. Internal company expertise and 
external advisors together can perform the 
identification. 


* Internal analysis: Either (a) employees 
specifically hired for the purpose, or (b) 
personnel located in key locations who 
interface with local and national social and 
political entities such as local leaders, 
politicians, NGOs and communities, can gather 
this risk information. They would know the 
business and therefore understand how 
particular social and political issues may affect 
the company. They will need a means of 


Host Country 
Local & 
National 

Governments 

& Regulators 





reporting on risks they identify. Coming from 
within the company, these personnel may, 
however, have a narrower view of the industry 
as a whole and be less sensitive to ‘red flags’ 
generated outside the company. Therefore, 
other sources of risk data can be used for a 
more inclusive set of risk indicators. 


External analysis: Boutique political risk 
analysis firms (such as those listed in Appendix 
2) are another source of risk data. These 
organizations supply country-specific reports. 
In some cases, they also calculate national 
ratings based on issues such as: risk from 
government, society, security, and economic 
factors. The benefit of information from this 
source is that (a) they give a broad 
understanding of a country’s current situation, 
(b) they update the information regularly, and 
(c) those generating the data are deeply 








23 


MANAGEMENT 


STRATEGY 


MEASUREMENT 


24 


knowledgeable about the regions they cover. 
In addition, the country risk ratings simplify 
the process of comparing countries. This is 
particularly useful when beginning new 
operations and trying to decide where to 
locate them. One limitation of the products 
these firms generate is that they are usually 
neither industry- nor region- specific. This is 
significant, since what could be lethal to one 
industry located in one part of a certain 
country could pose no threat whatsoever to 
another. In addition, these firms’ products are 
not monetized so as to be useful in 
investment decision-making. 


¢ Stakeholder scanning: Stakeholders such as 
suppliers, consumers, and surrounding 
communities are sources of data on social 
and political risk. Information can be 
gathered from surveys, interviews, community 
meetings, and market perception studies, as 
well as hiring local advisors. The drawback 
of these methods, particularly in countries 
where new operations are being established, 
is that undertaking the study could reinforce 
existing expectations of stakeholders that 
the company will find hard to meet. In 
addition, engaging stakeholders can sometimes 
embroil the company in local politics in 
unanticipated ways. For these reasons, a 
company wanting this information would be 
wise to seek assistance from a third party, or 
hire personnel trained in conducting social 
impact assessments. 


It is possible, and likely most useful, to combine 
elements of all of the above methods. For 
instance, a company could assign general risk 
oversight to several people within the 
company, while also enlisting personnel in the 
field and training them to be aware of ‘red flags 
indicating potential problems. Boutique 
political risk firms could supplement this 
country information at various stages of 
operations, and a social impact assessment 
could be undertaken periodically within the 
project life-cycle by a lending agency, a third 
party, or specifically hired personnel. This 
process should not, however, become all- 
consuming. Instead, companies should adopt a 
methodology for gathering and reporting 
information that is appropriate to the company 
and the project. Section IV further discusses 
reporting and decision-making. 


’ 


Il. ASSESSING & MEASURING 
SOCIAL AND POLITICAL RISK 








| A | Risk Identification 
Vv 


B | Risk Assessment & Measurement 


>| Generate ROI Model, Integrate Risk 
Vv 
Cc | Manage & Monitor Ris k 


























Ly» Respond: Avoid, Insure, Mitigate 
v 
D) Communicate Risks 








;-> Reporting & Decision -Making 








—»> The Role of Senior Management 





Business resource allocations are primarily based 
on ROI calculations. For a more complete 
analysis and improved operational and capital 
investment planning, ROI calculations must 
include political and social risks, to make them 
more explicit and relevant. 


After identifying the social and political issues 
that could affect the company, and compiling 
those issues into a comprehensive risk profile, 
metrics must be developed for each issue to 
assess their relative potential impact. One of the 
main aims of quantifying social and political risks 
is to integrate them into a financial model, 
thereby incorporating social and political issues 
into traditional risk analysis. We recommend 
including social and political risk in the financial 
equation through an ROI model, described 
below. Measurement of social and political risk 
through the following eight-stage process is 
illustrated in Exhibit 8: 


|. Calculate the benefit associated with each issue 
that may generate risk: For instance, shifting 
operations to Bangladesh could save 
significant money to a company’s payroll by 
employing personnel earning less than home 
office personnel. 

2. Calculate the potential costs associated 
with each political or social risk, including 
reputation costs. 

3. Estimate the probability that each risk will 
materialize. 

4. Multiply the potential cost of each risk by its 
expected probability of materializing to calculate 
the expected value of each risk. 
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Exhibit 8: Stages to Measuring Social and Political Risk 





1. CALCULATE 
BENEFIT OF EACH 
RISK ISSUE 








2. CALCULATE POTENTIAL 
COSTS, INCLUDING 
REPUTATION 








3. ESTIMATE 
PROBABILITY 








4, CALCULATE EXPECTED 
VALUE OF EACH RISK 








5. CALCULATE NPV OF EACH 
RISK 





6. AGGREGATE NPVS OF SOCIAL 
RISKS. 


7. AGGREGATE NPVS OF 
POLITICAL RISKS. 


8. CALCULATE EXPECTED VALUE 
0) <0) | 
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. Estimate when, over time, the risk may emerge. 
Calculate the net present value (NPV) of the risk. 


6. Aggregate the NPVs of all social risks. Insert 
as a line item in ROI calculations. 


7. Aggregate the NPVs of all political risks. 
Insert as a line item in ROI calculations. 


8. Calculate the expected value of the ROI. 


Social and political issues pose risks to companies 
that can be quantified and monetized, even if only by 
a rudimentary estimate. In fact, risks should be 
monetized for inclusion in ROI calculations, and to 
improve resource allocation and investment 
decisions. Product take-back and producer 
responsibility (requirements that companies accept 
responsibility for final disposal of their products like 
computer goods, cartridges, appliances, etc.) is 
increasingly common throughout the world. 
Similarly, site cleanup has become mandated in many 
locations, and companies are now recognizing that 
they did not consider these social and political risks 
when making costing decisions. This has led to 
underestimating total product cost. Better 
forecasting of potential changes in the social and 
political environment can lead to improved decision- 
making on process, product, and capital investment. 


Like other estimates used in financial analysis, these 
estimates are often imprecise. However, through proper 
estimating and disclosure, they certainly aid decision- 
making and are relevant in management discussions. 
Often, decision-makers will estimate ranges of costs 
and choose a point estimate for use in the analysis. The 
ranges, along with the measurement techniques used in 
the ROI analysis, would then be included as a footnote 
or appendix to the ROI calculation. Discussion of these 
ranges, and decisions on a certain point estimate, 
assists personnel in thinking about and communicating 
these often-neglected risks. Although the output of 
this practice is important, just as critical, ultimately, is 
the process for deciding on the appropriate issues, their 
associated costs, and the probabilities of occurrence. 
Ultimately, it is the board, the CEO, or the CFO, who must 
choose the appropriate metric. The quantitative analysis, 
ranges, point estimates, and ensuing discussion are critical 
elements in decision-making. The assumptions, decisions, 
and measurement techniques that lead to quantification 
of social and political risks must therefore be included 
as a footnote or appendix to the ROI analysis. 


Although calculations of the expected values of 
individual risks may be imprecise, the total 
estimate will likely move towards the mean. This 
greater precision occurs in a manner similar to the 
portfolio effect, where the propensity of risk on a 
well-diversified set of investments tends to fall 
below the risk of each individual component. 


Measuring the Cost of Risks 


Step |—Calculate Issue Benefit 





1. CALCULATE 


———~ 
ISSUE BENEFIT 








COSTS, ALSO REPUTATION 


3. ESTIMATE PROBABILITY 


4, CALCULATE EXPECTED VALUE 
OF EACH RISK 


2. CALCULATE POTENTIAL | 











5. CALCULATE NPV OF EACH 
RISK 





6. AGGREGATE NPVS OF SOCIAL RISKS. 
INSERT TO LINE ITEM 


7. AGGREGATE NPVS OF POLITICAL 


RISKS. INSERT TO LINE ITEM 


8. CALCULATE EXPECTED VALUE OF 
XO) f 
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Measuring the cost of social and political risks 
involves monetizing the savings and costs 
associated with each issue that could generate risk. 





MANAGEMENT 


STRATEGY 


MEASUREMENT 


26 


For example, when corporations are considering 
operating in a region where child labor is the 
norm, they may contemplate following this norm. 
In considering this option, the savings from using 
children would be calculated by measuring the 
difference in the wage rates between paying an 
adult and a child. The savings of using child labor 
would represent the issue benefit, which is 
generally assigned a positive value. 


Although some industries like clothing and shoe 
manufacturing have been seriously damaged by the 
use of child labor, and have therefore attempted to 
stop the practice, others like the chocolate 
industry did not consider this a risk. Children 
working as cocoa bean pickers were employed in 
the supply chain. Chocolate and candy 
manufacturers largely ignored the issue, until 
newspapers began publishing stories of kidnappings 
and forced child labor on cocoa plantations in 
West Africa. If the company considered this 
outcome, it should calculate each potential cost 
associated with employing this labor force, and the 
public discovering it. These costs could include: 


* Lost sales and other reputation impacts 
(measuring reputation is addressed in a 
later section); 


e Managing a consumer boycott by hiring a 
public relations firm, creating a new 
advertising campaign, hiring a stakeholder 
relations manager, communicating internally 
with employees, and senior management's 
time devoted to dealing with the issues; 


¢ Diminished brand value; and 


° Negative impact on recruiting potential hires. 


Step 2—Calculate Risk Costs, Also Reputation 





1. CALCULATE 
ISSUE BENEFIT 








2. CALCULATE RISK COSTS, 
ALSO REPUTATION 








3. ESTIMATE PROBABILITY 





4. CALCULATE EXPECTED VALUE 
OF EACH RISK 


5. CALCULATE NPV OF EACH 
RISK 





6. AGGREGATE NPVS OF SOCIAL RISKS. 
INSERT TO LINE ITEM 


7. AGGREGATE NPVS OF POLITICAL 
RISKS. INSERT TO LINE ITEM 


8. CALCULATE EXPECTED VALUE OF 
1X0) f 
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Each of these costs is assigned a value to get the 
risk costs of employing child labor. 


Measuring Reputation Risk 


Reputation risk is considered a cost resulting 
from, and therefore a secondary effect of, social 
and political risk. These include all of the real and 
perceived risks discussed in Appendix |.The 
process of identifying and measuring reputation 
risk is the same as for political and social risk. 


Polling firms, a public relations team, and 
information from other companies, can identify 
which stakeholders may view certain social and 
political issues negatively, thereby generating 
reputation risk. Exhibit 8 lists a number of 
stakeholders that should be considered. 


¢ Third-party polling: Polling by opinion 
research firms can provide a sense of how 
important these issues are to the company’s 
stakeholders, and how they might react. A 
company’s public relations team can calculate 
the impact of reactions like opting for another 
brand, boycotting, or a negative media campaign, 
based on numbers provided by polls and using 
methods similar to measuring brand value. 


¢ Surveys: Surveys can give some insight into 
the intensity of stakeholder reaction to 
certain issues. These “intensity of feeling” polls 
can be translated into monetary terms by 
asking questions about the impact of certain 
issues on buying products. The resulting 
numbers can then be calculated as lost sales. 


¢ Other companies: Researching the impacts 
on other companies that have experienced a 
similar issue can give insight into the 
monetary impact they experienced. 


The biggest cost of social and political risk is 
usually a reputation cost, typically as a result of lost 
sales due to consumer boycotts or protests. This 
can be measured through lost sales minus the cost 
of producing those goods, or the lost net profit. 


Share price and market share decline are two other 
potential issues to consider. Perrier was once the 
leading sparkling water brand in the U.S., holding 
80% of the U.S. imported bottled water market 
and close to 6% of the total bottled water market. 
In 1990, benzene was found in the bottled water 
sold in South Carolina and the company recalled 
70 million bottles in the U.S. and Canada, while 
claiming that it was an isolated incident. When 
similar contamination was discovered by Danish 
and Dutch officials, the company did a worldwide 
recall and claimed that benzene naturally occurred 
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in the carbon dioxide that makes its water 
“sparkling”, and was usually filtered out. They lost 
substantial market share. Six years later, Perrier’s 
sales was still at only one-half of its 1989 peak, and 
Perrier had to spend large amounts of money on 
increased advertising, free samples, and make other 
marketing and promotional expenditures in an 
attempt to recover its market share.'* 


Where possible, the impacts of share price and 
market share decline should be included in 
calculations as potential long-term losses. The 
costs of managing stakeholders in the medium to 
long-term, either through additional personnel or 
other strategies, should also be included. 


The professional services and insurance firm, 
Marsh & McLennan Companies, Inc., experienced a 
40 percent drop in its stock price when 
accusations of bid-rigging activity made the news 
in November, 2004. In addition to a downgrade of 
its debt by credit rating agencies due to its 
deteriorating reputation, Marsh & McLennan cut 
5% of its workforce on predictions of a 94% 
decline in its 3rd quarter profits.'® 


Step 3—Estimate Probability 





1. CALCULATE 
ISSUE BENEFIT 








2. CALCULATE RISK COSTS, 
ALSO REPUTATION 





3. ESTIMATE PROBABILITY 








4, CALCULATE EXPECTED VALUE 
OF EACH RISK 








5. CALCULATE NPV OF EACH 
RISK 





6. AGGREGATE NPVS OF SOCIAL RIsks. 
INSERT TO LINE ITEM 


7. AGGREGATE NPVS OF POLITICAL 


RISKS. INSERT TO LINE ITEM 


8. CALCULATE EXPECTED VALUE OF 
XO) | 
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After calculating the potential costs of each risk to 
the company, the potential likelihood, in percent, 
that each risk would occur and cause damage to 
the company, is approximated. This number is the 
estimated probability. (Later we calculate the 
impact on the company in expected value.) 


However, a footnote can be included in the ROI 
analysis that indicates that these numbers are 
midpoints (which would most likely settle within a 
range). An estimated probability should be 
assigned to each identified risk. For example, the 
estimated probability of the emergence of social 
and political risks for a fictitious coffee processing 
plant in Colombia could include: 


° Workers being kidnapped by the local militia: 
60%; 

° Being “taxed” by local militias or cartels: 25%; 

* Being found guilty and paying fines under the 
U.S. Foreign Corrupt Practices Act or other 
home country laws that regulate bribery and 
payoffs: 6%; 

* Supplier's coffee plantation destroyed by 
crop dusters as part of local government- 
led cocaine eradication scheme creating a 
supply gap: 27%. 

Step 4—Calculate Expected Value of Each Risk 





1. CALCULATE 
ISSUE BENEFIT 





2. CALCULATE RISK COSTS, 
ALSO REPUTATION 








3. ESTIMATE PROBABILITY 








4. CALCULATE EXPECTED VALUE 
OF EACH RISK 








5. CALCULATE NPV OF EACH 
RISK 





6. AGGREGATE NPVS OF SOCIAL RISks. 
INSERT TO LINE ITEM 


7. AGGREGATE NPVS OF POLITICAL 


RISKS. INSERT TO LINE ITEM 


8. CALCULATE EXPECTED VALUE OF 
1X0) f 
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After approximating the estimated probability, the 
expected value for each risk is calculated, by 
multiplying the estimated cost of the risk by the 
percent estimated probability of its 
occurrence. For example, if the costs of a reaction 
to use of child labor are estimated to be $100,000, 
and the likelihood that this risk would materialize 
is estimated 10%, then: 








Child Labor Risk Expected Value = ($100,000) x (10%) = $10,000 








14.“Perrier, Nestlé, And The Agnellis;’ Thunderbird Business School Case Study 


15. “Marsh & McLennan to cut 3,000 jobs,” The Business Journal of Milwaukee, November 9, 2004, and “Cherkasky says Marsh may 
settle Spitzer's lawsuit within a month: CEO is seeking to fix 40% drop in share price,” The Boston Globe, November 23, 2004. 
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After steps |-4 have been completed, the net 
present value (NPY) of each issue is calculated. 
Note that each issue has risks that emerge at 
different times. NPV is calculated on the 
outcome of: 


expected value 





I | 
PV benefits — PV[(cost;) x (% likelihood ;) + [(costz) x (% likelihood 2)...Risk, | = cost of risk 
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net i 


calculate NPV of issue 


Step 5—Calculate NPV of Each Risk 





1. CALCULATE 
ISSUE BENEFIT 








2. CALCULATE RISK COSTS, 
ALSO REPUTATION 








3. ESTIMATE PROBABILITY 








4, CALCULATE EXPECTED VALUE 
OF EACH RISK 








5. CALCULATE NPV OF EACH 
RISK 





6. AGGREGATE NPVS OF SOCIAL RISKS. 
INSERT TO LINE ITEM 


7. AGGREGATE NPVS OF POLITICAL 


RISKS. INSERT TO LINE ITEM 


8. CALCULATE EXPECTED VALUE OF 
ROI 


Qe — — SK MK MK RK eR eR eee er err rere eK eK 





NPV calculations for social and political risk are 
completed in the same way as traditional NPV 
calculations. Therefore, companies can use a table 
like that in Exhibit 9 to input the cost that the 
risk will incur, and the year that it will occur. 
Discounting back, using a set discount rate, is 
done in the traditional manner. These calculations 
are carried out for each identified social and 
political risk. For the purposes of these exhibits, 
we assume that project revenues and costs are 
converted to cash in each current year. The 
following example of a coffee plantation in 
Colombia illustrates this methodology. 


Calculating NPV for Social & Political Risk: 
An Example" 


In this example, a corporation already in the 
coffee-growing business is developing a coffee 
plantation in Colombia. Risks related to the 
coffee market, the corporation as a whole, and 
so on, need not be considered since the 
company is already in that business. The risks 


16.We thank Robert Torok for this example. 


that do need to be considered are those 
pertaining to this particular project. Earlier in this 
Management Accounting Guideline (MAG), we 
identified a number of typical social and political 
risks/business decisions that any project would 
face; in Exhibit 9, we include those that could 
apply to this project. 


For the purposes of the example, we have 
selected the business decision on possible use of 
child labor to reduce project costs and thus 
increase profitability and/or reduce the product 
cost to consumers. Since this is an opportunity 
(rather than a risk), the first step is to quantify 
the gross benefit, say $8 million/year, an amount 
partially offset by $300,000 in up-front training 
and related costs (year | only). 


The second step is to quantify the risks by 
determining the probability of each risk occurring, 
and its financial impact. This is shown in Part | of 
the table in Exhibit 9.The direct net benefit of the 
opportunity is therefore expected to be: 


* Year |: $8,000,000 — 300,000 — 1,530,000 = 
$6,170,000 

° Year 2:$8,000,000 — 2,880,000 = $5,120,000 

* Year 3: $8,000,000 — 5,580,000 = $2,420,000 

* Year 4: $8,000,000 — $1,380,000 = $6,620,000 


Assuming a 10% discount rate, the Net Present 
Value of this opportunity (assuming that the 
benefits and costs are incurred in the middle of 
each year) is calculated as (all figures rounded to 
nearest ‘000): 

¢ $6,170,000 discounted 6 months = $5,876,000 
¢ $5,120,000 discounted |8 months = $4,433,000 
¢ $2,420,000 discounted 30 months = $1,905,000 
¢ $6,620,000 discounted 42 months = $4,737,000 
¢ NPV = $16,951,000 


However, this analysis does not yet reflect the 
impact on the company’s reputation and resulting 
lost sales, nor the efforts required to recoup 
those losses. Here are some common examples 
of elements of reputation risk: 


. Employee relations and attitudes 
. Product quality, reliability, safety 


. Customer relations 


hwWN 


. Presence in foreign markets (i.e. not is it in 
market x but how does it act, how is it 
perceived?) 
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Supply chain partners and practices 
Community relations 


Fiduciary responsibility 


eNO MH 


Behavioral standards, code of ethics, etc. 
(loosely called business practices) 


9. Quality of management 


For purposes of the example, the company considers 
elements |, 3,6,and 8 to be relevant. The approach 
then follows the same steps as were taken earlier for 
the quantitative aspects, that is, estimate the 
probability of the impact being felt, its timing, and the 
resulting costs. The principal differences when dealing 
with reputation risk are that second-order effects, 
including the costs of mitigating the initial loss and a 
longer period, are involved. 


This is shown in Part 2 of the table in Exhibit 9, 
which calculates reputation risks totaling 
$2,675,000 in year |, $5,350,000 in year 2, and so 
on through year 6.The NPV of these risks can also 
be calculated. Again assuming a 10% discount rate 
and that all costs are incurred mid-year; the NPV 
of the risks would be approximately $38.5 million. 


In total, therefore, the NPV of the opportunity = 
$16,951,000 - $38,500,000 = ($21,549,000) - a 
rather poor choice! 


Steps 6 and 7—Aggregate NPVs of Social Risk; 
Aggregate NPVs of Political Risk 





1. CALCULATE 
ISSUE BENEFIT 








2. CALCULATE RISK COSTS, 
ALSO REPUTATION 








3. ESTIMATE PROBABILITY 








4. CALCULATE EXPECTED VALUE 
OF EACH RISK 


5. CALCULATE NPV OF EACH 
RISK 





6. AGGREGATE NPVS OF SOCIAL RISKS. 
INSERT TO LINE ITEM 


7. AGGREGATE NPVS OF POLITICAL 
RISKS. INSERT TO LINE ITEM 


8. CALCULATE EXPECTED VALUE OF 
1X0) | 
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Once all NPVs for social and political risks have 
been calculated, the social risk NPVs should be 
added together, as should the political risk 
NPVs.The aggregate social risk NPV and the 
aggregate political risk NPV should then be 
inserted as line items in the normal ROI 


calculation. Schedules should be provided that 
show the calculations of benefit, expected value, 
likelihood, and cost of social and political risk, as 
illustrated in Exhibit 10. It is critical that senior 
management see both the process and the 
output of doing these calculations. 


Schedules A and schedule B in this exhibit list 
examples of mock social and political risks. 
Schedule A lists risks that could emerge for a 
company, for instance in the extractive industry, 
that operates in an unstable region. Although some 
issues that emerge, such as civil unrest near the 
site, would likely not present any benefits, others, 
such as establishing operations on indigenous 
lands, can produce short-term savings because of 
low land prices. However, costs associated with 
these social risks are incurred that include: 


* Remuneration for indigenous land; 


* Hiring someone to negotiate with protesters 
or assigning some of current employees’ time 
to those negotiations; 


* The cost of extra security to protect the site; 
° Hiring a community relations manager; 


* Executive time spend strategizing on managing 
NGO relations; 


* Work stoppages due to community protests; 
* Reputation damage; and 


* The potential for litigation fees and fines if the 
issue goes to court. 


Unlike some social risks, most underlying causes of 
political risks do not present any savings to a 
company. Although entering a country with political 
instability can bring both benefits and costs, anti- 
business legislative changes, policy changes or 
contract re-negotiation that would be considered 
risks offer a company little or no benefit. Favorable 
policy or legislation changes, however, would not be 
considered political risk as defined here. Schedule B 
lists various costs the company would incur if the 
risks mentioned were to materialize. For instance, if 
there is an armed insurrection targeting the 
company site, costs could include: 


° Hiring private security to protect executives 
and their homes; 


* Training personnel in self-defense (defensive 
driving, home invasion protection, etc.);and 


° Extra training of local police who protect the 
company site on the level of force company 
standards allow (where they go beyond local 
laws), to protect the company from litigation 
for human rights abuses. 
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If the company overseas faces endemic 
corruption, costs associated with this risk 
could include: 


* Dollars (or equivalent) paid directly in bribes, 
or other methods of payment to facilitate 
transactions; 


° Legal fees and fines if found guilty of bribery 
practices in a lawsuit filed under the Foreign 
Corrupt Practices Act or similar legislation; 
and 


* Reputation damage sustained by the 
company for being associated with a 
corrupt regime. 


Reputation costs have been included as a 
separate line item in each schedule because 
they represent a large component of social 
and political risk. In addition to how 
reputation costs were treated in the previous 
reputation risk section, they can be listed as 
lost sales and profits. 


Step 8—Calculate Expected Value of RO! 





1. CALCULATE 
ISSUE BENEFIT 








2. CALCULATE RISK COSTS, 
ALSO REPUTATION 














3. ESTIMATE PROBABILITY 





4, CALCULATE EXPECTED VALUE 
OF EACH RISK 





5. CALCULATE NPV OF EACH 
RISK 


6. AGGREGATE NPVS OF SOCIAL RISKS. 
INSERT TO LINE ITEM 


7. AGGREGATE NPVS OF POLITICAL 
RISKS. INSERT TO LINE ITEM 


8. CALCULATE EXPECTED VALUE OF 
CO) | 


W]e — Keg Me Me MP Me Be Be Be Me BP ee Be Be Ee Ee EK = 


Once Schedules A and B have been calculated, 
their results can be integrated into traditional 
ROI calculations, as illustrated in Exhibit 10. 


Integrating political and social risks into ROI 
calculations enables managers to better 
understand (a) the full range of risks their 
operations face, and (b) their costs. Although the 
output of the analysis is useful, the analyzing process 
itself also provides the opportunity to strategize 
for risk management—either to develop ways to 
avoid the risk, or to create risk mitigation plans. 


Ill. MANAGE & MONITOR 
POLITICAL AND SOCIAL RISK 


A| Risk Identification 
Vv 


[B| Risk Assessment & Measurement 

















F Generate ROI Model, Integrate Risk | 


C| Manage & Monitor Risk 


L. Respond: Avoid, Insure, Mitigate 
Vv 
| D | Communicate Risks 
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The Role of Senior Managemen t 


¢ RESPONDING TO RISK: INSURANCE, 
AVOIDANCE, MITIGATION 


Taking these steps to identify social and political 
risks and to measure their potential costs begins 
a process of integrated risk management that (a) 
allows for a new understanding of the full scope 
of operating risks, and (b) provides the 
groundwork for managing these risks. Unlike 
financial risk, which can usually be shared or 
transferred, this is often not possible with social 
and political risks in an environment where firms 
are often held liable for their suppliers’ 
misdemeanors, either in the court of law or 
public opinion. In the early 1990s, when Nike’s 
global labor practices were being criticized, 
protesters did not typically differentiate 
between the company’s 20,000 employees and 
the half million indirect contractors working in 
565 contract factories in 46 countries, about 
whose working conditions they were protesting. 
Photos of children in Pakistan sewing soccer 
balls in dismal conditions peppered the news, as 
did stories of paying women 14 cents per hour 
to sew shoes in Indonesia, and workers’ 
exposure to toxic chemicals in Vietnam. Nike did 
not have the option to buy risk insurance to 
mitigate the losses incurred from these anti- 
Nike campaigns. Nor could the company 
distance itself from the subcontractors who ran 
the contract factories and set the rules—this 
had been Nike’s initial response, but it failed to 
stem the tide of criticism. 


Managing political, social, and reputation risk 
includes devising policies and programs to 
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EXHIBIT 10: Integrating Social and Political Risk Costs in ROI Calculations 


CALCULATE THE MONETARY BENEFITS OF 
THE PROJECT 


OUTPUT REVENUES 


Labor cost savings 


New customer base 


[3 | CALCULATE THE PROJECT ROI 


Total Benefits — Total Costs 
ROI = ---------------------------------------- * 100 
Capital Costs (Investment) 
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SCHEDULE A 


COSTS OF SOCIAL RISKS 








Risk 





Civil unrest 
surrounding site 


Benefit Cost types 
Costs of engaging employees 
skilled in negotiating with 
protesters 
Cost of engaging extra 
security personnel 

Reputation-Related: 

Cost of hiring community 
relations manager 

Cost of managing activist 
NGO relations 





Likelihood Expected Value 





Prostitution near 
site 


Child Labor 


Infringement of 
indigenous 
lands 


Costs of implementing health 
education for workers to 
teach about sexually 
transmitted diseases (to avoid 
costs related to HIV 
infection) 
eputation Related: 
™ Costs of reputation damage 
= Cost of managing boycotts 
when information reaches 
activist consumers 
= Cost of NGO-relations 
manager 
" Costs if litigation in 
international courts 
= Cost of remunerating 
population 
= Cost of work stoppages due 
to local strike, reputation 
damage, community protests, 
work stoppages 
eputation-Related: 
Cost of hiring community 
relations manager 
= Cost of managing activist 
NGO relations 


Reputation Costs, including lost sales and profits 
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SCHEDULE B 





COSTS OF POLITICAL RISKS 











Benefit 
Changes in 
legislation that 
change the 
tules of the 
game 
Forced 
contract 
renegotiation 
with host 
government 
Armed 
Insurrection 


Lost revenues 
Increased taxes and tariffs 


Lost profits 
Lost investment 


Cost of hiring private security 
Cost of training local 
police/military to prevent 
human rights abuses (if 
required to use these forces 
by contract) 


Expected Value 





Associated Reputation Risk 


Endemic 
corruption 


Targeted 
criminal 
activity 


Terrorism 


Cost of incentive packages to 
attract workers to location 


Cost of protests, etc. due to 
potential linkages with 
human rights abuses 

Costs of payoffs and bribes 


Costs of potential lawsuits 


for that activity 
Cost of lost contracts for 
refusing to engage in that 


Costs of protecting personnel, 
including extra security, 
reinforcing security at private 
homes, providing security 
training to employees and 
families 

Costs of attracting workers, 
including increased pay, time 
off and hardship bonuses 
Costs of increased security to 
protect facility 

Costs of potential work 


Costs of reinforcing 
infrastructure 
Cost of hiring additional 
security personnel 

= Cost of rebuilding 





Reputation Costs, including lost sales and profits 


NPV 
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identify, measure, monitor, respond to, and report 
on risk, as well as formulating methods to avoid 
or mitigate identified risk. As outlined in the 
identification section, risk identification occurs 
through internal analysis, evaluation of 
information from risk firms, and stakeholder 
analysis. Effective management calls both for 
monitoring of political and social risks, and 
communication to management of changes in 
their levels. Monitoring does not have to be 
exhaustive—it can involve selecting certain 
indicators, such as advertising campaigns about 
child labor, for observation. 


Responding to social and political risk can 
happen in four ways: 


¢ Insuring against risk when possible; 
° Avoiding risk; 
° Mitigating risk; or 


* Some combination of these. 


@ Political risk insurance 


Both public sector bodies and private firms offer 
political risk insurance, in use since the 1970s. 
Public sector insurers such as the World Bank 
and government-backed plans seem to have 
proven a useful deterrent to host governments 
interfering with investments—the World Bank’s 
Multilateral Investment Guarantee Agency 
(MIGA) has paid out a political risk claim only 
three times in its eighteen year history.'” This 
low rate of payout is due to a number of factors: 


¢ MIGA does significant due diligence on 
insurable projects and the political 
environment before offering a guarantee. 
Presumably, it has identified and mitigated 


many potential risks before underwriting; 


¢ Countries are members of MIGA, and the 
organization always requests government 
approval before issuing a guarantee for a 
project in their country. Presumably, the 
government's approval indicates that it is 
fundamentally happy that the investment is 
meeting some part of its development agenda, 
hence making the investment “safer” from 
adverse government attention in the future; 


* MIGA has some influence with governments, 
by virtue of its membership in the World 
Bank Group, and so is able to work with 
clients and governments if a potential claims 
situation emerges, to try to reach an amicable 
solution for all parties, to avoid a claim. 


Political risk insurance plans usually insure 
against: (a) confiscation, expropriation or 
naturalization; (b) currency inconvertibility; 

(c) property destruction; (d) business 
interruption and other disruptions associated 
with war, terrorism, and other civil disturbances; 
(e) contract frustration. Likewise, Export 
Development Canada (EDC), a crown 
corporation of the Canadian government and 
the Overseas Private Investment Corporation 
(OPIC), a U.S. government agency, offer political 
risk insurance to Canadian and American 
companies, respectively. Private firms like Marsh 
& McLennan and Aon also offer protections for 
potential losses due to expropriation, currency 
inconvertibility, and war. Exhibit | | illustrates the 
risks covered by Aon political risk insurance. 


Political risk insurance is, however, of limited use. 
Sometimes the market cannot or will not cover 
the investment because it is simply too large, as 
in the case of some major infrastructure 


Exhibit | 1: Risks Covered by Aon Political Risk Insurance” 


Confiscation, expropriation / nationalization of holdings / fixed or current assets, including 
"creeping expropriation" and selective discrimination; 
Cancellation, suspension or withdrawal of concession permits, exploration licenses or 


operating licenses; 


Deprivation of rights to own and use an asset, including cancellation of re-export licenses; 


Deprivation of collateral held as security for loans; 
Forced abandonment or forced divestiture; 
War, terrorism, sabotage and other forms of political violence; 
Foreign exchange restrictions; 
Breach of government undertakings on which the investment was predicated. 





17. Judith Pearce, Lead Operations Officer, MIGA. Discussion with author, April 2006. 


18.Aon political risk insurance for investment. <http://www.aon.com <accessed January 2006> 
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projects. Even when coverage can be obtained, 
however, it is usually limited to risks that are 
“quantifiable and provable,” and presumably 
insurers have a way to limit claims so defined. 


@ Avoid Political & Social Risk 


Another method of dealing with political and 
social risk is to avoid it, either by making pre- 
emptive risk mitigation plans, or by deciding not 
to undertake a project whose risk-return ratio 
is too low.When Shell and Mobil Oil were 
considering a liquefied natural gas concession in 
Peru’s Lower Urubamba Valley, one of the 
world’s most biologically diverse regions, they 
engaged in extensive discussions with the 
government, local indigenous tribes, local 
environmental groups, and international 
advisors. As a result, the companies developed 
plans adapted to local conditions, but 
nonetheless decided to withdraw because of 
combined local and international opposition to 
the project and disputes with the government.” 


@ Mitigate Social & Political Risk 


Another option is mitigation. In this alternative to 
managing social and political risk, creative solutions 
are devised to lessen the cost of a risk’s impact 
and/or to diminish the likelihood of the risk 
emerging. While designing solutions to diminish 
risk, it is useful to refer back to the potential 
sources of risk outlined in Exhibit 7. Understanding 
these sources and what motivates them will allow 
managers to devise targeted solutions. 


For example, a firm with operations in South Africa 
is faced with a growing number of employees who 
are becoming symptomatic and dying of AIDS. The 
company has decided that the prospect of moving its 
operations to another location is unattractive for 
business reasons. It is therefore forced to bear a 
large overhead cost due to absenteeism, high 
turnover, and the need to consistently train new 
skilled personnel for jobs left open because of 
AIDS-related deaths. In the long-term, the company 
projects that this problem will only get worse—as 
the AIDS-related mortality rate in South Africa grows 
exponentially, the company assumes that the rates 
within the company will too. Understanding that the 
risk is a social one, generated by lack of awareness, 
education, and perhaps social stigma associated 
with the illness, may allow the company to devise 
location-specific solutions to address the risk. 


When strategizing how to mitigate the risk from 
HIV/AIDS, a business can consider a variety of 
alternatives. One option is to do nothing, leaving 
the risk unmitigated. Another is to try to mitigate 
the risk once it has materialized, by establishing a 
variety of programs such as workplace education, 
condom distribution at work sites, voluntary HIV 
testing at facilities, and medical treatment for 
workers and families. A firm contemplating 
entering the South African market could also 
entertain a third choice, pre-emptive mitigation. In 
this case, the company would undertake risk- 
reducing programs mentioned previously as part 
of the market entry strategy, instead of waiting for 
the risk to emerge and affect its business. 


Exhibit |2 illustrates these three approaches, first 
one that calculates the estimated value of the 
project with no mitigation (the base case), then 
pre-emptive mitigation, and finally mitigation when 
the risk has materialized: 


* Norisk mitigation: This base case option 
analyzes the impact of not taking any action to 
address or mitigate risk. Calculations include 
the operation’s value and the impact of risk on 
the operation: 





Operation Value Unmitigated Risk = 


(Operation Value) + /— [(Political/Social Risk 
costs) x (%likelihood)] 





* Pre-emptive mitigation: This option analyzes 
the impact on the operation if the risk were to 
be mitigated before it emerges. Calculations 
include: the operation’s value, the expected cost 
of implementing mitigation programs, projected 
long-term savings from those mitigation 
programs, and any reputation value they 
produce. Note that some risk still exists, even 
with pre-emptive mitigation, but this will likely 
result in a lower cost than if no mitigation were 
undertaken, because programs are commenced 
before the risk emerges. This does not imply 
that there will be zero risk-related cost; rather 
that both the likelihood of risk emergence and 
the associated cost will likely be lower: 





Operation Value Preemptively Mitigated Risk ~ 
(Operation Value) + / — [(Lowered Political/Social 
Risk costs) x (lowered % likelihood)] 

— [Mitigation Program (Savings — Costs)] + (Net 
Change in Reputation Value) 











19. James Grimaldi.“Texas Firms Line Up U.S.Aid in Peru: Gas Project's Damage to Rain Forest Assailed,” Washington 


Post. November 20, 2002. 
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Project Value_[ Sw] 


Rsk COSTS LIKELIHOOD (-) EXPECTED COST 


HIV increasing among Cost to replace personnel 
personnel resulting in employee Cost to re-train personnel 
illness and death Personnel turnover 


inefficiencies 


Reputation Value (-) 


Risk Reduced Total Operation Value 


PRE-EMPTIVE RISK MITIGATION FOR ONGOING OR 
NEW OPERATIONS 


Project Value [Sw 


LOWERED RISK LIKELIHOOD (-) EXPECTED COST 


HIV increasing among Cost to replace personnel 

personnel resulting in employee Cost to re-train personnel 

illness and death Personnel turnover 
inefficiencies 


MITIGATION PROGRAMS COSTS (+) SAVINGS (=) EXPECTED VALUE 


Mitigation-Gained Reputation Value (+/-) 


Cc MITIGATED RISK FOR ONGOING OPERATION 


work sites 
* HIV testing at facilities 
* medical treatment for 
workers & families 
a ee 


LIKELIHOOD (-) EXPECTED COST 


HIV increasing among Cost to replace personnel 
personnel resulting in employee Cost to re-train personnel 
illness and death Personnel turnover 


inefficiencies 


MITIGATION PROGRAMS (-) COSTS 


condom distribution at 


(+) LT SAVINGS (-) EXPECTED VALUE 


work sites 

HIV testing at facilities 
medical treatment for 
workers & families 

Move families together so 
men not separated 


Mitigation-Gained Reputation Value (+/- eee 


Preemptive Mitigation Operation Value ee | 
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Changes in the likelihood and the costs 
associated with the risk can occur during 
mitigation, requiring additional calculation. 


* Mitigating risk when it has materialized: 
This option analyzes the impact on the 
operation if a mitigation strategy is undertaken 
after the risk has presented itself and had an 
impact. Calculations include the operation’s 
value, the impact of risk on the operation, the 
cost of undertaking one, several or all of the 
mitigation programs, and the long-term savings 
these would generate. Another impact that 
should be included is any positive impact on 
reputation from a mitigation strategy: 





Operation Value post materialized Mitigated Risk — 
(Operation Value) + / — [(lowered Political/Social 
Risk costs) x (lowered % likelihood)] 

— [Mitigation Program (Savings — Costs)] + (Net 
Change in Reputation Value) 











These also can create changes in costs and 
likelihood, again requiring further calculation. The 
results of these calculations can then be compared 
for cost efficiency on a net present value basis. 
Pre-emptive mitigation strategies, often the same 
actions as post-emergence mitigation activities, will 
frequently lower the likelihoods and costs beyond 
those that could be realized from undertaking 
mitigation after a risk has emerged. Exhibit |2 
illustrates these three approaches. 


Day-to-Day Operations versus Capital 
Investment Planning 


In addition to the process outlined in Exhibit 12 
for ongoing operations, considering the three 
options can be helpful when evaluating capital 
investment decisions and comparing various 
possible locations. In these cases, it is useful to 
gather risk data on all of the most likely 
operational locations, and determine the likelihood 
that risks will emerge for each. Doing this allows 
managers to compare various locations, 
understand the most relevant and dangerous risks 
in each location, and include them in decision- 
making to determine the best alternative. In 
addition, by thinking through the costs of the risks 
and generating pre-emptive mitigation strategies, 
decision-makers can determine whether it is in 
their best interest to wait for the risk to emerge, 
or to incorporate programs into the project 
design that would mitigate risk at the outset. 


IV. COMMUNICATING SOCIAL AND 
POLITICAL RISK 


Risk Identification 


B | Risk Assessment & Measurement 


Generate ROI Model, Integrate Risk 




















C} Manage & Monitor Risk 








Respond: Avoid, Insure, Mitigate 
v 
D Communicate Risks 
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The Role of Senior Management 


REPORTING AND DECISION-MAKING 


Successful corporate management of social and 
political risks is predicated on integrating such 
risks into management systems, and on effective 
communication both within the firm and with 
external stakeholders. Employees at all levels must 
be apprised of senior management’s commitment, 
for better inclusion of social and political risk into 
decision-making. In addition, management should 
communicate (a) information about the company’s 
approach to risk, (b) how it defines social and 
political risk, (c) the potential consequences of 
risks if they are left unmitigated, and (d) means of 
reporting on potential hazards. Internal 
communication can be undertaken during 
trainings, via the company’s intranet, in company 
manuals, and through focused bulletins. 


It is also critical to establish appropriate company 
and project internal reporting mechanisms for 
employees to report on risk. An internal 
reporting system is particularly useful for 
collecting data on risk in the “identification” stage 
outlined in this paper. However, to avoid relying on 
employees to contribute risk-related information, 
specific risk management personnel should be 
identified to be alert for risks, so as not to side- 
line the risk issue. Personnel can either be hired 
specifically for a risk management function, or 
cross-functional teams can undertake the work, 
staffed with individuals from various departments 
tasked with this responsibility. 


As outlined in Epstein and Rejc (Reporting of 
Organizational Risks, 2005), organizations are 
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recognizing the need for broader internal and 
external risk reporting—for enlightened internal 
decisions and for improved analysis and better 
decisions of external stakeholders. However, 
standardized general templates for broad risk 
reporting do not exist. 


Reporting social and political risks in monetary 
terms is, however, an important part of 
integrating these issues into financial planning. In 
so doing, these risks climb from their current 
position as a mere footnote to the financial 
calculation, to a position that accurately reflects 
the devastating impact they can have. 
Transforming the discussion of political and 
social risks from a largely qualitative to a 
quantitative one emphasizes their relevance. 
Although quantifying social and political risks is 
often imprecise, it is the first step to integrating a 
wider set of risks into calculations that will more 
accurately reflect the true nature of risk in an 
increasingly interconnected world. 


Internal Reporting 


Internal reporting on social and political risks is 
critical to sound decision-making and risk 
management. Boards of directors, risk 
management committees, and senior managers 
need timely information about the effectiveness 
of internal controls, as well as risks, including 
social and political ones. 


* Boards of directors have responsibility for 
overseeing the development and 
implementation of the company’s mission, 
values, and strategy. This includes careful 
review of processes of risk identification, 
monitoring, and management (Epstein and 
Roy, 2002). 


* Risk management committees’ oversight 
requires a substantive understanding of 
corporate risks and internal controls. Their 
duty is to review and evaluate the 
effectiveness of the company’s process for 
assessing risks, and the steps that 
management is taking to monitor and control 
those risks. Doing so requires the committee 
to receive, review, and consider both broad 
risk reports as well as issue- or project- 
specific ones (Epstein and Roy, 2002). 


¢ Senior management's need for information 
regarding organizational risks is of particular 
importance. Senior management needs 
relevant, accurate, and reliable real-time risk 
reports for effective decision-making and 
control. Without proper internal reporting on 


organizational risks—strategic and 
operational ones, in particular—senior and 
other managers cannot make the best 
strategic and tactical decisions. Only by 
generating both a broad understanding and 
analysis, supported by targeted, specific and 
detailed schedules of risk-related information, 
can organizations inform senior managers and 
other decision-makers with facts, not 
intuition. They can then appropriately 
integrate those risks into more effective 
management decisions that advance the 
organization’s strategy and goals. 


¢ Employees want safe and secure working 
conditions, as well as corporate financial 
stability, and are interested in what may 
jeopardize both. In addition, as members of 
the community-at-large, they are often 
interested in the company’s impact beyond 
the workplace. 


Reporting on social and political risks should be 
integrated with communication on other risks, 
including the compliance, reporting, strategic, 
and operational risks outlined in Exhibit |. 
Particularly when reporting is aimed at (a) risk 
managers, (b) the risk management committee, 
(c) the CFO, and (d) if the results are serious 
enough, the CEO and the board, discussion of 
social and political risk should include: 


¢ An outline of current risks faced by the firm, 
the projected likelihood of occurrence and 
their potential costs; 


¢ The source of these risks;and 


* Mitigation strategies, their potential costs, 
and the management plan if that strategy 
is undertaken. 


However, internal risk reporting that leads to 
dysfunctional behavior of different internal 
audiences, such as a reduction in appropriate risk- 
taking of managers that is necessary for business 
success, can impose costs on the organization. 


External Reporting 


Increasingly, shareholders and other stakeholders 
are aware that disclosing only current financial 
risks—market and credit risks—does not 
provide sufficient information about 
organizational and financial performance, because 
these are also affected by other risks, including 
social and political ones. Although external 
reporting is not mandatory, some parties that 
may be interested in a deeper knowledge of a 
company’s risks include: auditors, regulators, 
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shareholders, creditors, financial analysts, 
customers, suppliers, consumers, and the media. 
After identifying, assessing, and possibly responding 
to social and political risks, companies must decide 
whether they should be reported externally and, if 
so, to whom and at what level of detail. Report 
content will vary with the user. 


When contemplating external risk reporting, 
however, potential costs must be weighed. 
Voluntary disclosures should therefore be subject 
to careful cost-benefit analysis. The primary 
potential costs of external risk reporting are 
believed to be: (a) competitive disadvantage from 
informative disclosure, (b) bargaining disadvantage 
from the disclosure to suppliers, customers, and 
employees, and (c) unmerited lawsuits attributable 
to disclosures. The greater the level of detail about 
a specific risk, the greater the likelihood of 
competitive disadvantage. Thus, some enterprises 
may wish to undertake a cost-benefit analysis 
regarding how much information on social and 
political risk to report externally. The timing of a 
disclosure also affects its potential for competitive 
disadvantage, because at some stage disclosure 
loses its capacity to create competitive advantage. 
(Epstein and Rejc, 2005). In their Management 
Accounting Guideline, The Reporting of 
Organizational Risks for Internal and External 
Decision-Making, Epstein and Rejc outline a 
method for a cost-benefit analysis for reporting, 
as well as modes of data presentation, so that 
risks can receive proper consideration while not 
causing undue alarm. 


THE ROLE OF SENIOR MANAGERS 


Senior financial managers play a critical role in 
measuring, managing, and reporting social and 
political risks. In addition to signaling the 
importance of the issue to all levels of the 
company, senior management, boards of directors 
(and audit committees), and various other 
financial stakeholders need the information 
generated by quantified social and political risk 
analysis to better understand and manage the 
risks facing the company. 


Inclusion of social and political risks plays a critical 
role in due diligence regarding both internal and 
external decisions. Understanding the potential 
threats from political and social issues in ongoing 
operations can mean the difference between 
being pre-emptive and resilient when faced with 
catastrophe, or being caught unaware, with 


potentially tremendous negative effect on 
revenues or costs. Likewise, appreciating that 
social and political risk may materialize, and 
understanding the resulting hidden costs to the 
company is critical in due diligence for major 
investment decisions. When undertaking 
acquisitions and mergers, these risks are also a 
factor that should not be ignored. 


That said, a financial professional must provide a 
complete and fair presentation of organizational 
risks without being seen as alarmist, and thereby 
causing a reduction in appropriate risk-taking 
that is necessary for business success. To this 
end, integrating social and political risk into 
financial calculations allows for comparison with 
other risks, putting them in a context so that 
they can be understood along with other 
challenges. Measuring a project’s attractiveness 
by including social and political risks into its 
economics is not the intended end point of the 
methodology outlined in this MAG. Rather, 
measurement is only one important component 
in a project review that must include dialogue 
about the levels of risk and the likelihood of its 
emergence. The project analysis must be 
shaped to provide background and generate 
discussion on ways to manage risks, as well as 
alternatives that could shift the trade-off 
between risk and return. 


CONCLUSION 


In an increasingly globalized world, integrating 
social and political risks is critical to effective 
management of a company’s real risks, and to 
improved resource allocation. This demands the 
quantification of social and political risks in an 
atypical manner. To account for these risks, they 
must be identified, measured, monetized, and 
included in ROI calculations. Social and political 
risks that can devastate a company’s operations 
can be adequately accounted for, rather than being 
relegated to a footnote to financial calculations in 
the hopes that the risks will not emerge. 
Measurement of social and political risks also 
enables decision-makers to devise mitigation 
strategies, sometimes pre-emptively, that can 
produce significant cost savings. This Management 
Accounting Guideline provides a method to 
include social and political risks in financial 
calculations, and to integrate them into overall risk 
management for improved decision-making. 
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APPENDIX |: REAL AND 
PERCEIVED RISK 


Factoring in the stakeholder perspective allows 
social and political risks that companies face to 
be separated into real and perceived risks. 
Stakeholder reactions to an issue can transform 
their perceptions of a company’s involvement 
with a matter of concern (perceived risk) into a 
real risk for the company, and increasing a 
company’s costs. Real risk includes all social and 
political issues that (a) result from business 
activities, and (b) external actions (like 
nationalization of industries) imposed on the 
company that affect its business. Perceived risk 
includes all issues that stakeholders, including 
consumers, employees, and communities hold a 
company responsible for, whether or not 
evidence supports the perception. 


It is important to identify real and perceived 
risks, and their sources, to better manage them. 
Both real and perceived risks carry financial 
costs to the company and can cause significant 
reputation risk. Real and perceived risk can be 
combined in three ways: 


* Real and perceived: risks created by a 
company’s actions that lead to a reaction 
from affected constituent, or risks generated 
by a social or political issue that directly 
affects a company’s profits. 


* Real and not yet perceived: risks created 
by a company’s actions that affect some 
constituents, but who are not yet aware of it 
and therefore have not yet reacted. Some of 
these may not be perceived by the company 
or society at large for some time. In the 
short-term the risk is real, but may have no 
immediate effect or cost. Once stakeholder 
perceptions change, however, either through 
greater information or shifting sensitivities, 


the risk to society manifests, and the reaction 


to it can lead to significant costs for the 
company. Sometimes the stakeholders 
identify the risk before the company does, 
and the company is taken by surprise, with 
very negative consequences. Coca-Cola 


worked in Kerala, India for years. Its water use 


was not recognized as an issue by the 

company, by its stakeholders, or by the public 
at large. Then, in the mid-1990s, members of 
fifty villages surrounding Coca Cola’s bottling 


plant claimed that the company was siphoning 


off drinking water and depositing waste with 
high cadmium and nickel content in the 
surrounding areas. Soon international 


activists joined in. Although the outcome of 
the legal battle was settled in Coca Cola’s 
favor, information about the issue has spread 
quickly to both North America and Europe, 
sparking anti-Coke protests. As a result of 
the ongoing lawsuits, trouble with the local 
community, and worldwide protests, Coca- 
Cola weighed the revenues produced by 
doing business in Kerala against the cost to its 
reputation worldwide, and decided the price 
it was paying was too high. As a result it 
decided to leave Kerala. 


Coke’s experience illustrates that in an age of 
24-hour news, the Internet, and text 
messaging, information can spread across the 
globe, mobilizing people and leading to 
negative impacts on reputation. Activists 
today can use the Internet to spread 
information, whether it is factual or not, 
within seconds. Twenty years ago, information 
was passed by mail or by telephone from one 
person to another person. Today, activists’ 
global reach and connection to one another 
across vast distances, coupled with high public 
trust in the non-governmental organization 
(NGO) sector, make it much easier for 
activists to attack companies and put them on 
the defensive. This makes it more difficult for 
companies to deal with and react to risk 
situations, particularly ones generated by 
perception. Some risks, like Coca-Cola’s 
water use in India, are, in the short-term, not 
risks at all, because they are not presently 
noticeable to stakeholders. However, these 
issues have the potential for long-term 
damage to reputation when the risk 
materializes or perceptions change. 


Perceived and not real: the company is 
perceived, because of its business practices, 
location, reputation, or targeting by activists, 
to have caused damage or created a risk to 
society, even though it has not. The company 
is held to account because various 
stakeholders react through, for example, 
customer boycotts, strikes by workers, etc. 
These reactions in turn create a risk and a 
cost to the company. Shell’s 1995 Brent Spar 
experience is a case in point. The company 
decided to dispose of its decommissioned oil 
platform by sinking it in the North Atlantic. In 
response, Greenpeace activists carried out 
intensive campaigning in Northern Europe, 
claiming that Shell was being environmentally 
irresponsible, and that sinking the Brent Spar 
would dump 5500 tons of oil in the sea, 
wreaking havoc with the environment. In 
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addition, 25 activists occupied the platform and 
the organization encouraged boycotts of Shell 
stations that resulted in some violent attacks 
and threats to Shell workers. In the face of 
falling sales and a drop in share price, the 
company commissioned a third party to 
investigate Greenpeace’s allegations, which 
were later acknowledged to be inaccurate, 
leading to an apology by the activists to Shell. 
Shell suffered substantial losses from the Brent 
Spar incident, because of lost sales, reputation 
damage, time by management dedicated to 
managing the incident, other internal company 
resources applied to the issue, and the cost of 
the diversion from ongoing operations. 
Reputation risk is further discussed in a later 
section. The costs resulting from the Brent Spar 
incident occurred as a result of perceived risks 
to the community, rather than actual ones. It is 
important that companies effectively manage 
both the perception that their activities pose a 
risk to society, and any actual or real risks their 
operations may create. Both of these can 
create costs for the company. 


Company-generated risk to society, or society's 
perception that a company is causing a negative 
impact, can create a feedback loop. In such a 
feedback loop, illustrated in Exhibit Appendix |, the 


company’s activities create a risk to society [1] (or 
society believes that business operations are having 
a negative impact); members of society, the 
company’s stakeholders, become aware of this risk 
through various means including the Internet [2]; 
these stakeholders react to the identified risk by 
protests, strikes, boycotts, adverse legal verdicts, or 
fines [3]; and these stakeholder reactions create real 
risks to the company’s ability to do business [4]. 


Risk generated from perception, here called 
perceived risk, can represent an equal or greater 
threat to the company than risk generated by real 
social and political issues, since the consequences 
can be as dire and the costs as high. Although 
liability for real risk may be expressed through 
fines and the cost for tasks like environmental 
cleanup, accountability for perceived risk can be 
expressed through lawsuits and boycotts, both of 
which have real costs. 


Differentiating between real and perceived risks is, 
therefore, critical to identifying potential hazards, 
thinking through their prospective impacts, and 
designing mitigation techniques. A manager 
weighing the consequences of the various options 
must factor public opinion, even if it is based on 
erroneous information, into decisions about the 
best course of action. The potential costs of both 
real and perceived risks are very high. 


Exhibit Appendix I: The Real and Perceived Risk Feedback Loop 
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THEIR OFFERINGS” 
CONSULTING FIRM 
Control Global 
Risks Group 


The Economist — Global 

Intelligence Unit 

Eurasia Group Asia, Latin 
America, 
Europe, 
Eurasia, 
Middle East, 
Africa 

Kissinger Global 

McLarty 

Associates 

Political Risk Global 

Services Country 

Forecasts 


SCOPE SERVICES OFFERED 


* Political and security 
risk analysis 
* Security consultancy 
* Crisis management and response 
* On-line risk assessment service 
* Country Risk Forecast 
measuring the impact of 
political and security 
developments on businesses 
and business activities 


* Country analysis 

* Forecasts 

* Risk assessment 

* Economic and market data 
* Industry trends 


* Country analysis 

* Forecasts 

* Risk assessment 

* Economic and market data 

* Trends in global energy, 
homeland security, bio-security 


* High-level intervention regarding 
special projects, assist clients to 
identify strategic partners and 
investment opportunities, and 
advise clients on government 
relations 


* International Country Risk Guide 
provides assessments of political, 
economic, and financial risk based 
on analysis of worldwide experts, 
subject to a peer review process 


PRODUCT 


* Impact-likelihood matrix to 
measure 8 aspects of risk 

¢ 120 Country Risk Forecast: 
analysis of political, security 
and travel risks, ranked 
extreme, high, medium, 
low or insignificant 


* Reports 
¢ Market Indicators and 
forecasts 


* Political stability index, 
produced with Deutsche 
Bank 

* Publications 

* Consulting 


* Strategic advisory services 
* Advocacy services 


* Assess 12 components of 
political risk (military in 
politics, democratic 
accountability, internal conflict, 
government stability, 
bureaucratic quality, 
investment profile, law and 
order, corruption etc.), 

* 5 components of economic risk 


20. Adapted from: Campbell, A and David Carmet.“The Private Sector and Conflict Prevention Mainstreaming: 
Risk Analysis and Conflict Impact Assessment Tools for Multinational Corporations.” Carleton University, 


May 2002. 
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